Malicious Curl Downloader
Krasimir Konov If you want to easily download and save remote files, curl is an excellent command-line tool for Windows and Unix. It supports HTTP, HTTPS, and…
WordPress Admin Login Stealer
During an investigation, we identified a WordPress login stealer using the PHP functions curl and file_get_contents. The malicious code was injected into the core file…
Fake M-Shield WordPress Plugin
During a recent malware investigation, we found a fake WordPress plugin called M-Shield. We also found almost an identical plugin under the name kingof, with…
How to Protect Personally Identifiable Information (PII) from Search Engines
In today’s internet age we take our privacy for granted. We sign up for many services which are “free.” We participate in giveaways and generally…
Phishing and Malware via SMS Text Message
We’ve recently noticed an increase in reports of phishing and malware being distributed via SMS text messages. During one investigation, we identified fake messages sent…
Malicious Android Application Used in Phishing Scam
While we deal with a lot of phishing cases, we rarely see mobile applications used as part of a phishing campaign—these apps add a layer…
Cryptominers & Backdoors Found in Fake Plugins
When cleaning websites, we regularly find phishing pages, malicious code injected into files, and SEO spam. However, over the past couple of months we’ve also…
Malicious Plugin Used to Encrypt WordPress Posts
During a recent cleanup, we found an interesting malicious WordPress plugin, “WP Security”, that was being used to encrypt blog post content. The website owner…
EE wireless provider phishing malware
A large number of phishing targets include popular services such as banks, payment providers, and email services. In this type of attack, fraudsters create fake…
Self-destruct malware
The majority of malware we find on compromised websites have been planted by bad actors with the intention of concealing and accessing backdoor access. During…
web.config Redirect Malware
We recently found this malware on a windows hosting server where the web.config file was modified with the following code. The code redirects multiple user…