Spam Doorway Manager
Luke Leal While investigating a client’s compromised website, we saw a malicious file that was being used to manage an existing SEO spam doorway. We usually refer…
Fake Google Domains Used in Evasive Magento Skimmer
We were recently contacted by a Magento website owner who had been blacklisted and was experiencing McAfee SiteAdvisor “Dangerous Site” warnings. Our investigation revealed that…
Backdoor plugin hides from view
One of the most important traits for backdoors is the ability to remain undetected by most users — otherwise it may draw suspicion and be…
FBCMS Pharmacy Spam Website
Whenever most people think of a website CMS, they most often think of the popular options like WordPress, Joomla, or Drupal. What do all three…
Reset Email Account Passwords after Website Infection: Follow Up
In a previous analysis of a malicious file, we demonstrated why you should always update your email account passwords after a security compromise. The information…
Stolen Payment Data: Infected Ecommerce Website to Darknet Markets
The final actor of the stolen payment data supply chain is the end user. Rather than just selling or reselling payment data, the end user…
Magento Killer
A malicious PHP script, aptly given the name “Magento Killer” by its creator(s), has been found targeting Magento websites. While it doesn’t actually kill the…
Fake Instagram Verification
Across various social media platforms there are verification checkmark symbols that appear near the name of the account’s page we view. For example, this verified…
Cryptomining Dropper and Cronjob Creator
Recently, someone reached out to us about a malicious process they had discovered running on their web server. This process was maxing out the CPU,…
PHP Backdoor Evaluates XOR Encrypted Requests
In the past, we’ve mentioned how the PHP XOR bitwise operator (represented by the caret ^) can be used to encrypt a malware’s source code.…
Return to the City of Cron – Malware Infections on Joomla and WordPress
We recently had a client that had a persistent malware infection on their shared hosting environment that would re-infect the files quickly after we had…