Multiple UNIX users symbolic link injector
Yuliyan Tsvetkov Recently we found a very interesting malware that injects symbolic links in each and every Linux/UNIX home folder. Once the website is infected, it uses…
New Guide on How to Fix Hacked Joomla! Sites
Alycia Mitchell Joomla! is one of the most popular open-source content management systems (CMS) on the market, powering a large percentage of websites on the internet today.…
Malicious routine stealing WordPress credentials in the wild
Douglas Santos From the hacker’s perspective, maintaining access to a compromised website for as long as possible, is ideal. One way to achieve this goal, is by…
New XM1RPC SEO Spam and Backdoor Campaign
Fernando Barbosa We have been monitoring a new campaign specifically targeting WordPress sites, using hundreds of them for SEO spam distribution. We call it the XM1RPC campaign…
Unwanted Sex Toys Advertisement
Eugene Wozniak Recently, during an incident response process, we have found an advertisement floating banner on specific pages of an html-based website. Despite what people think, these…
Labs Notes Monthly Recap – Oct/2016
Estevao Avillez In our September Labs Notes Recap, we listed recent discoveries made by our Incident Response and Malware Research Teams. These monthly recaps serve to bridge…
New version of Magento Credit Card stealer in the wild
Cesar Anjos Hacking into Magento sites and injecting code to steal payment information is very profitable and it’s the biggest trend we are seeing in 2016. It is interesting enough to notice that the same group is being responsible for several attacks.
Spotlight: How Big Spring Secures Joomla!
Big Spring Web Development understands the responsibility to their clients extends beyond creating a functional and attractive website. Security and stability are critical components of…
Learning From Buggy WordPress Wp-login Malware
Denis Sinegubko When a site gets hacked, the attack doesn’t end with the malicious payload or spam content. Hackers know that most website administrators will clean up…
WordPress Theme Mailing Script being exploited in the wild
Rodrigo Escobar A few weeks ago, we posted a lab notes describing a good theme file being exploited by attackers to send mass-mailing SPAM (http://labs.sucuri.net/?note=2016/08/15 0:00). Upon…
Joomla Exploits in the Wild Against CVE-2016-8870 and CVE-2016-8869
Daniel Cid Exactly 3 days ago, the Joomla team issued a patch for a high-severity vulnerability that allows remote users to create accounts and increase their privileges…