From Fake Updates to Unwanted Redirects

  • March 8, 2019
Labs Note

At the end of February, we wrote about a massive wave of site infections that pushed fake browser updates.

In the beginning of March, the attack evolved into redirecting site visitors to sketchy ad URLs.

In WordPress, the injected script is typically found at the bottom of footer.php files of the active theme. It still comprises of an “eval(function(p,a,c,k,e,d)…” obfuscated script and Histats code with the same 4214393 ID (which is now found on 1564 sites).

Denis Sinegubko is Sucuri’s Senior Malware Researcher who joined the company in 2013. Denis' main responsibilities include researching emerging threats and creating signatures for SiteCheck. The founder of UnmaskParasites, his professional experience covers over 20 years of programming and information security. When Denis isn’t analyzing malware, you might not find him online at all. Connect with him on Twitter.

Related Tags
Related Categories
You May Also Like