Naive CoinHive Injections
Denis Sinegubko Since CoinHive domain made it into many blacklists, attackers began avoiding linking to the hosted library file https://coinhive .com/lib/coinhive.min.js. Instead, they uploaded this file to…
Browsing Category
Website Malware Infections
867 posts
Reversed URLs Randomly Redirect to Scams
We are seeing hundreds of infected WordPress sites with the following scripts (in one line) injected in random places in wp_posts table. $vTB$I_919AeEAw2z$KX=function(n){if (typeof ($vTB$I_919AeEAw2z$KX.list[n])…
Using Google and Facebook to aid on distribution
Fioravante Souza Every now and then I check my spam mail box for interesting malware (yes, I receive a lot of phishing messages and alerts that my…
Malicious Cryptominers from GitHub
Recently, a webmaster contacted us when his AVG antivirus reported that the JS:Miner-C [Trj] infection was found on their site. Our investigation revealed a hidden…
Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites
Update Dec. 8 2017: The cloudflare[.]solutions domain has now been taken down. A few weeks ago, we wrote about a massive WordPress infection that injected an…
WP-VCD Malware Comes with Nulled Themes
Recently we wrote about wp-vcd malware that created rogue WordPress admin users (100010010) and injected spam links. Our readers noticed that the “nulled” premium theme…
Backdoor using paste site to host payload
Bruno Zanelato Over the last months, we’ve been talking a lot about new ways to decode complex malwares that involve the usual PHP functions like eval, create_function,…
IPv6 address in malicious Javascript redirect
Luke Leal We recently came across a file that shows an interesting case with a Javascript malicious code injection in a website’s custom script file, though it’s…
Fake jQuery and Google Analytics Hide Yet Another Cryptominer
This is a quick posts about yet another quite massive attack that installs CoinHive JavaScript Monero miners on compromised websites. You might have already read…
New wave of wp-vcd Malware
Krasimir Konov Recently we saw a new wave of a known malware that injects malicious WordPress admin users to vulnerable or compromised sites.The malware, well analysed by…
Cryptominers on Hacked Sites – Part 2
Last month we wrote about how the emergence of website cryptocurrency miners resulted in hackers abusing the technology by injecting the CoinHive miners into compromised…