The Hidden PHP Malware that Reinfects Cleaned Files
Luke Leal Website reinfections are a serious problem for website owners, and it can often be difficult to determine the cause behind the reinfection — especially if…
Browsing Category
Sucuri Labs
336 posts
phpbash – A Terminal Emulator Web Shell
It’s common for hackers to utilize post-compromise tools that contain a graphical user interface (GUI) that can be loaded in the web browser. A GUI…
Missing DMARC Records Lead to Phishing
Kaushal Bhavsar Email will continue to be the dominant mode of digital communication for the foreseeable future. However, the email framework was not designed with security in…
WordPress Malware Disables Security Plugins to Avoid Detection
An alarm or monitoring system is a great tool that can be used to improve the security of a home or website, but what if…
Reflected XSS in WordPress Plugin Admin Pages
Antony Garand The administrative dashboard in WordPress is a pretty safe place: Only elevated users can access it. Exploiting a plugin’s admin panel would serve very little…
Using assert() to Execute Malware in PHP 7 Environments
Krasimir Konov Initially released December 2015, PHP 7 introduced a multitude of performance and security improvements. Approximately 43.7% of websites across the web currently use PHP 7.x,…
Persistent WordPress User Injection
Our team recently stumbled across an interesting example of malicious code used to add an arbitrary user inside WordPress. The following code was detected at…
Magento Multiversion (1.x/2.x) Backdoor
The Magento 1 EOL date has already passed, however it’s evident that a large number of websites will continue to use it for the foreseeable…
COVID-19 Chloroquine Pharmaspam
A recent SiteCheck scan of an organization’s website showed an interesting pharmacy spam injection targeting COVID-19-related pages of websites. The HTML that was flagged by…
CDN-Filestore Credit Card Stealer for Magento
During a website remediation, we recently discovered a new version of a Magento credit card stealer which sends all compromised data to the malicious domain…
Web Crawler & User Agent Blocking Techniques
This is a simple script that allows hackers to block specific crawlers based upon website requests from specific user-agents. This is useful when you don’t…