A threat actor labelled as MUT-1244 has stolen more than 390,000 WordPress credentials.