On February 8th, 2018, we noticed a new wave of WordPress infections involving two malicious plugins: injectbody and injectscr. These plugins inject obfuscated scripts, creating unwanted pop-up/pop-unders. Whenever a visitor clicks anywhere on an infected web page, they are served questionable ads.
Plugin Location
The malicious plugins possess a very similar file structure:
Injectbody
wp-content/plugins/injectbody/
injectbody.php: 2146 bytes (the plugin code)
inject.txt: 2006 bytes (injected JavaScript)
Injectscr
wp-content/plugins/injectscr/
injectscr.php: 1319 bytes (the plugin code)
inject.txt: 3906 bytes (injected JavaScript)
The functionality of these plugins are also very similar. As their names imply, they inject a script from inject.txt and hide their presence on the plugin list within the WordPress dashboard.
Plugin Code
Let’s take a look at the short and simple code for these plugins:
injectbody.phpinjectscr.php
As you can see, both of the plugins include functions to hide their existence: injectscr_hide and injectbody_hide. These functions remove the malicious plugins from the list of active plugins. Only the attackers, who can log into WordPress using the malicious admin users INJECTBODY__ADMIN or INJECTSCR__ADMIN, or alternatively use legitimate admin credentials and append “?INJECTBODY__ADMIN=1” or “?INJECTSCR__ADMIN=1” GET parameters in the URL, are able to detect the presence of these malicious plugins on an infected website.
Injected scripts
Once a website has been infected, the hidden injectbody plugin begins injecting an obfuscated script into a website page:
var _0xc3ce=["\x32\x20\x35\x3D\x7B\x61\x3A\x27...removed for brevity... new RegExp(_0xc3ce[7]+ _0xf262x5(_0xf262x3)+ _0xc3ce[7],_0xc3ce[8]),_0xf262x4[_0xf262x3])}};return _0xf262x1}(_0xc3ce[0],27,27,_0xc3ce[3][_0xc3ce[2]](_0xc3ce[1]),0,{}))
It adds a Viglink ad script with the “ca8b3984fdf6c76dc2fe3325feb58eba” key to a page.
The injectscr plugin injects a similar obfuscated script:
var _0x3fdb=["\x39\x20\x62\x28\x6B\x29\x7B\x33\x20...removed for brevity...new RegExp(_0x3fdb[8]+ _0x3e49x5(_0x3e49x3)+ _0x3fdb[8],_0x3fdb[9]),_0x3e49x4[_0x3e49x3])}};return _0x3e49x1}(_0x3fdb[0],62,63,_0x3fdb[3][_0x3fdb[2]](_0x3fdb[1]),0,{}))
The script adds an “onclick” handler that opens a popup window with the following URL: hxxp://1aqy.xn--o1aqy[.]xn--p1ai/stats/fri.php?affid=79803 This is just the first step in a chain of ad redirects.
When the popup is opened, the script sets the “clickund_expert=1” cookie for one hour and removes itself from the onlick event handler.
Log Analysis
After analyzing the logs of infected websites, we discovered that the attackers added the plugins after they had logged into WordPress dashboard:
These plugin installation requests are most likely automated. It takes only a mere 10-20 seconds from opening the login page to fully installing and activating the plugins. These installation requests have been primarily coming from random IPs, but we’ve listed a few of the IP addresses that have been participating in this attack: 95.221.199.162, 186.95.168.192, 220.79.30.57, 1.179.244.194. These requests utilize fake Firefox user agents like “Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/4912” and include weird random 3-4 digit versions of Firefox like 4912 or 793A – however, the latest version of Firefox at the moment is just 58.0.1 (Firefox/58.0)
Related Infections
Our researchers have identified a number of websites with injectbody/injectscr plugins that were previously infected in January with a related infection. This malware sent out tons of spammy emails using uploaded files with random names like “class-mailer.php”, “wp-scsys.php”, “wpn-sops.php”, “wp-sclouds.php”, etc. The attack also created backdoors and file uploading scripts in random locations on the server.
Mitigation
There are a number of ways that you can mitigate some of the risks of this infection.
1. Don’t rely on what you see in the WordPress admin interface, as some active plugins may be hidden from you. Please inspect wp-content/plugins manually for anything that should not be there. If located, you should remove wp-content/plugins/injectbody/ and wp-content/plugins/injectscr/.
2. Hackers logged into WordPress to install the plugins. This means they either know your admin password or created rogue admin users for themselves so it’s important that you do the following:
2.1. Change all WordPress passwords (at least for admins) ASAP!
2.2. Review the list of users, especially those with administrator roles. You should definitely delete any users with the following logins: INJECTBODY__ADMIN or INJECTSCR__ADMIN.
3. Make sure your site is not infected with older types of malware associated with these same attackers – or any other malware, for that matter. Be sure to keep an eye out for any backdoors as well, as they frequently contribute to website reinfections.
For more information about cleaning hacked WordPress sites, you can check our guides on WordPress security.
Update (Feb 15, 2018):
We’ve identified a couple more malicious plugins installed by this attack: plugins/antisp/antisp.php and plugins/spamdetectvr/spamdetectvr.php.
These plugins possess the same structure as injectbody/injectscr, but include different rogue admin users: antisp__ADMIN and SPAMDETECTVR__ADMIN respectively. The injected scripts (from inject.txt) are also a bit different.
The antisp plugin injects a script that begins with “var _0xa7af=[…”, which is a variation of the “clickund_expert” script from the injectscr plugin, with a different interstitial domain (xn--i1av6a.xn--p1ai / яфй.рф – created on February 6, 2018 ). A variation of the Injectscr plugin also uses the яфй.рф domain and, in this case, the obfuscated script may begin with “var _0xde98=[…”.
Spamdetectvr injects a script that begins with “eval(function(p,a,c,k,e,d){e=function…” and, when decoded, it is similar to the viglink ad script injected by the injectbody plugin, but with “af3e68a3f417d7dd0db45cfcfb34cbb1” as the key.
Update (Feb 16, 2018):
We have identified another malicious plugin: wpheadsp.php with wpheadsp__ADMIN user and “var _0xa7af” script in the in.txt file.
On some sites, the malicious scripts are also appended to the core WordPress .js files: wp-includes/js/jquery/jquery-migrate.min.js and wp-includes/js/wp-embed.min.js.
Denis Sinegubko is Sucuri’s Senior Malware Researcher who joined the company in 2013. Denis' main responsibilities include researching emerging threats and creating signatures for SiteCheck. The founder of UnmaskParasites, his professional experience covers over 20 years of programming and information security. When Denis isn’t analyzing malware, you might not find him online at all. Connect with him on Twitter.
During a recent investigation, our malware remediation team encountered a variant of a common malware injection that has been active since at least 2017. The…
Whether it is your own or a website you are visiting, undesired redirects and pop-ups are always annoying. The situation gets worse when your visitors…
Attackers are always looking for new ways to conceal their malware and evade detection, whether it’s through new forms of obfuscation, concatenation, or — in…
While investigating the SiteGround Optimizer and Caldera Forms Pro plugins we have discovered a critical privilege escalation vulnerability. It was not being abused externally and…
Recently, we came across another way to use files from GitHub repositories in malware infections. This time the infections weren’t via GitHub.io, raw.githubusercontent.com, or github.com/<user>/<repository>/raw/…
Some attackers seem to like signing their scripts. This fact is especially true for defacements and backdoors, where attackers show their pride stating that they…
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…
Puja Srivastava
Rianna MacLeod
Cesar Anjos
Denis Sinegubko
Ben Martin
Marc-Alexandre Montpas
Jose Martinez