Mail from the ‘Boss’ – A Classic Example of a $_POST Mailer Stealing CC Data
Yuliyan Tsvetkov We often find mailer scripts while cleaning malicious code from websites. Some of them are easily discovered, while others are obfuscated or heavily encoded. These…
Protecting Phishing Pages via .htaccess
Phishers usually want to protect their pages from being detected by search engines and security companies. To achieve that, they add .htaccess files that deny…
The elegant dropper – reusable code for PHP shell installation
During our malware research role, we analyze hundreds (if not thousands) of malware samples every day. Quite often, highly-obfuscated techniques are used by attackers to…
Malicious Image Defacement Hidden from Search Engines
After carefully designing a theme and images that represent your brand, nothing is worse than seeing a malicious image suddenly associated with your business or…
Attackers Silently add new user with Administrator role to WordPress sites
Attackers tend to get smarter in order to avoid detection, as well as gain access to your WordPress site. They use legit functions of the…
Set your Cookie, Execute a Command
Backdoors evolve. They tend to get more complex, harder to understand and harder to decode, but this is not always the case. Most of the…
Monetized JavaScript Redirect to Free Porn Webcams for Mobile Devices
Attackers will do desperate and obvious things to boost the views of their ‘customers’. On a daily basis we find different malicious redirects (some are…
Hiding malicious code from the user using white spaces
Over the years, attackers have used different techniques for hiding malicious files on websites. They obfuscated code, changed legit functions to execute malware, modified whole…
Joomla admin login bypass – set your UA for full admin access
Every day we analyse hundreds of new malicious files. Some of them are simple backdoors, injected iframes, or one liner defacements. Another type of malware,…
Web shell downloader – simple attempt to avoid detection
When dealing with compromised scenarios, our team has to be very thorough to remove all pieces of malware in the infected website. Most of the…
Malicious script injected to WordPress theme allowing Admin Login Bypass
On a daily basis we find different kinds of malware like backdoors, credit card stealers, injected scripts, and phishing pages. While each one of those…