Threat intelligence gathering from slight changes in malicious code samples
Luke Leal We found the following PHP backdoor in August 2018 along with other malware samples uploaded after hackers exploit a specific vulnerable WordPress plugin covered in…
array_diff_ukey Usage in Malware Obfuscation
We discovered a PHP backdoor on a WordPress installation that contained some interesting obfuscation methods to keep it hidden from prying eyes: $zz1 = chr(95).chr(100).chr(101).chr(115).chr(116).chr(105).chr(110).chr(97).chr(116).chr(105).chr(111).chr(110);…
xmlrpc.php Brute Force Tool
We discovered a xmlrpc.php brute-force tool in a malicious PHP script that appears to have been uploaded months ago after a vulnerable GDPR plugin exploit:…
How Stolen Ecommerce Data is Sold on the Darknet
We have recently published posts regarding banking malware and some of the ways it uses compromised websites to infect victim’s devices (smartphones, computers, POS terminals).…
WP Plugin Hider
One of our analysts recently found an interesting injection that has been found on WordPress installations. Installed by hacker, it is used to hide a…
Reset Email Account Passwords After a Website Malware Infection
It’s not uncommon for bad actors to use compromised websites to send large amounts of email spam. This can cause major headaches for website owners…
Malware Campaigns Sharing Network Resources: r00ts.ninja
We recently noticed an interesting example of network infrastructure resources being used over a period of time by more than one large scale malware campaign…
Hackers Use Fake Google reCAPTCHA to Cloak Banking Malware
The most effective phishing and malware campaigns usually employ one of the following two age-old social engineering techniques: Impersonation These online phishing campaigns impersonate a…
Array String Obfuscation
We continue to see an increase in the number of these PHP injections that use multiple obfuscation methods to evade detection, but lately one method…
Unsuccessfully Defaced Websites
Defaced websites are a type of hack that is easy to notice and a pain for website owners. Recently, we came across some defacement pages…
“Google Fonts” popup leads to malware
A recent malware injection in a client\’s WordPress file was found to be targeting website visitors that were using the Google Chrome browser to access…