Core Integrity Verifications
Gerson Ruiz In order to clean a malware infection, the first thing we need to know is which files have been compromised. At Sucuri, we use several…
Browsing Category
WordPress Security
698 posts
Fake Font Dropper
Moe O Every day we see different website infections. When we receive unusual or interesting cases, our researcher instincts are triggered to investigate the unusual website behavior…
Massive WordPress Redirect Campaign Targets Vulnerable tagDiv Themes and Ultimate Member Plugins
Denis Sinegubko This August, we’ve seen a new massive wave of WordPress infections that redirect visitors to unwanted sites. When redirected, users see annoying pages with random…
Fake Plugins with Popuplink.js Redirect to Scam Sites
Since July, we’ve been observing a massive WordPress infection that is responsible for unwanted redirects to scam and ad sites. This infection involves the tiny.cc…
RawGit CDN is Abused by CryptoLoot Cryptominers
Recently, we came across another way to use files from GitHub repositories in malware infections. This time the infections weren’t via GitHub.io, raw.githubusercontent.com, or github.com/<user>/<repository>/raw/…
Using Innocent roles to hide admin users
Cesar Anjos All across the internet we find guides and tutorials on how to keep your WordPress site secure, and they all approach the concept of user…
WordPress Update – 4.9.7 Security & Maintenance Release
Marc-Alexandre Montpas The WordPress team has just released a critical security and maintenance update to resolve a number of bugs and security issues. Included in this release…
CoinImp Cryptominer and Fully Qualified Domain Names
We are all familiar with the conventional domain name notation, where different levels are concatenated with the full stop character (period). E.g. “www.example.com”, where “www”…
Google and Facebook Used in Phishing Campaigns
Fioravante Souza We’ve all seen sketchy looking emails or texts with malicious links to click on. There are still people who fall for these more obvious types…
JQuory: Cryptomining in Nulled Themes and Plugins.
Three months ago b>@ninoseki</b revealed a group of sites with cryptomining scripts inside jquory.js files (yes, jquory instead of jquery). Coinhive(“I2OG8vGGXjF7wMQgL37BhqG5aVPjcoQL”) is trigged by “jquory.js”.…
Unwanted Ads via Baidu Links
The malware attack that began as an installation of malicious Injectbody/Injectscr WordPress plugins back in February has evolved since then. Some of the changes were…