Fake bb_press Plugin Redirects to Mobile Pornography
Fernando Barbosa When a website is hacked, we often find that attackers have injected multiple backdoors, web shells, and malicious code that allows them to regain access…
Cloned Spam Sites in Subdirectories
In a recent post, we covered how attackers were abusing server resources to create WordPress sites in subdirectories and distribute spam. By adding a complete…
New XM1RPC SEO Spam and Backdoor Campaign
We have been monitoring a new campaign specifically targeting WordPress sites, using hundreds of them for SEO spam distribution. We call it the XM1RPC campaign…
Malicious WordPress Subdirectory Installs For SEO Spam
Remediating over 500 infected sites per day, we see attacks executed at varying levels of complexity. The tactics attackers use to compromise a site provide…
Backdoor abusing of PHP tricks
During an incident response process, we found a very interesting malicious code abusing some PHP tricks. Attackers placed the malware at the end of a…
Backdoors abusing of spaces
Lately we’ve seen more backdoors that have some specific characteristics, like using several spaces between the code and processing information coming from POST requests. Attackers…
Malicious Pop-ups in vBulletin
Pop-up ads are annoying. Unfortunately many sites rely on them to pay for their operational expenses and even to make some extra cash. However when…
Fake WordPress Installs and Sunglasses Spam
Spammers are constantly looking for ways make use of resources of hacked sites in their black hat SEO schemes. In most cases, spam injections and…
JScript ASP.NET Backdoor
Backdoors can be simple and powerful at the same time. They’re also very common to be seen along with any kind of infection so that…
File Uploader in Drupal Database
It’s very common to see backdoors such as uploaders among site’s files. However, we have seen more often cases where file uploaders, mainly in Drupal…
vBulletin Still Redirecting to Myfilestore.com
MyFileStore[.]com redirects from vBulletin sites have been a problem since 2011. It is associated with the VBSEO plugin with multiple unpatched vulnerabilities that has been…