Phishing for Anonymous Alligators
Denis Sinegubko Everyone has encountered phishing at some point – fake emails and web pages designed to look legitimate. This tactic is becoming more popular as attackers…
Malware in comments
There are many tricks to hide malicious code. One of them is placing it to the part of legitimate files where people don’t normally expect…
FormCraft v1.4.6 under attack
As we clean many sites infected by the VisitorTracker malware, we see vulnerabilities in multiple plugins being exploited by attackers. For example, my colleagues John…
Analyzing Black Hat URL Shorteners
Hackers are known to use URL shortening services to obfuscate their real landing pages. It’s very effective in clickbait scams on social networks. Some hackers…
Minimalistic WordPress injection
WordPress-specific malware is slightly different than generic PHP malware. Inside WordPress files, it can use WordPress API and WordPress database. This allows to create this…
.htaccess Tricks in Global.asa Files
As you might know a lot of hacks use Apache configuration .htaccess files to override default web site behavior: add conditional redirects, create virtual paths…
Malicious Google Search Console Verifications
This past summer we noticed a trend of more and more Blackhat SEO hacks trying to verify additional accounts as owners of compromised sites in Google Search…
Hacked Sites Help Hack Third-Party Sites
Just a reminder that your hacked site may be used to anonymously hack third-party sites. This Joomla com_Myblog exploit script was found on one hacked…
Tag-cloud-generator com script redirects to parked domains
Today we found a few websites that loaded strange code from tag-cloud-generator[.]com. Sites tried load several image and font files from this site, but they…
Fake Social Share WordPress Plugin Creates Pharma Spam Doorways
We found infected sites where malware created a fake WordPress plugin that generated pharma spam doorways. Path: wp-content/plugins/social-share/wp-social-share.php This file creates wp-content/plugins/social-share/share.php that calls itself…
Wigo Means Bingo for Blackseo Agent
This week my colleague Peter Gramantik showed me a few infected sites that had very similar code embedded in the WordPress index.php files: if (eregi(‘-dbst’,$_SERVER[‘REQUEST_URI’]))…