Fake WordPress Functions Conceal assert() Backdoor
Douglas Santos A few weeks ago, I was manually inspecting some files on a compromised website. While checking on a specific WooCommerce file, I noticed something interesting.…
Why is Your Website a Target? The SEO Value of a Website
Website security is what we eat, sleep, and breathe. It’s what we do best because we deal with hacked websites every single day, thousands of…
A Puzzling Backdoor Upload
After a successful compromise, backdoors are frequently left behind and function as a point of re-entry into the website environment. These malicious pieces of code…
Javascript Injection Creates Rogue WordPress Admin User
Earlier this year, we faced a growing volume of infections related to a vulnerability in outdated versions of the Newspaper and Newsmag themes. The infection…
The Tale of a Malicious Stored Procedure
Nowadays, the most common issues with database injections are related to SPAM. Brian Krebs has a book called Spam Nation, that gives us a more…
Malicious routine stealing WordPress credentials in the wild
From the hacker’s perspective, maintaining access to a compromised website for as long as possible, is ideal. One way to achieve this goal, is by…
Joomla Backdoor Hidden in Plain Sight
In order to avoid detection and maintain access to compromised websites, attackers use different techniques to hide their malicious code. During our cleanup investigation we…
200k+ Parked/Expired Domains Used to Distribute Malicious Ads
Recently we wrote about domain renewal scams that used real paper letters to tricks site owners into transferring their domains and renewing them for 3-4x…
MiniCMS as a Spam Site Generator
SEO spam is very common for a reason — money. Spammers are paid to promote websites on Google. We deal with lots of SEO spam…
WP Mobile Detector Vulnerability Being Exploited in the Wild
***Update: The WP Mobile Detector plugin has been patched to address the vulnerability. Please update as soon as possible. Note that the latest version don’t…
Magento CC stealer adding user’s credentials to the loot
While analyzing a compromised Magento site, we found another Credit Card (CC) stealer variation. We posted a few times about this type of malware, but…