Fake SUPEE-5344 Patch Steals Payment Details
Denis Sinegubko Update 2/17: This post is not about hackers tricking webmasters into installing fake Magento security patch. It’s about malware that pretends to be an applied…
Seo-moz.com SEO Spam Campaign
Bruno Zanelato Here at Sucuri we handle countless cases of SEO spam. This malware involves a website being compromised in order to spread (mostly pharmaceutical) advertisements by…
Magento PCI Compliance Issues and Theft Over TLS
With about 30% of the market share, Magento is gradually becoming a “WordPress” of the ecommerce world. Like WordPress, it becomes a major target for…
Server Security: Import WordPress Events to OSSEC
Daniel Cid We leverage OSSEC extensively to help monitor and protect our servers. If you are not familiar with OSSEC, it is an open source Intrusion Detection System…
Massive Admedia/Adverting iFrame Infection
This past weekend we registered a spike in WordPress infections where hackers injected encrypted code at the end of all legitimate .js files. The distinguishing…
The Risks of Hiring a Bad SEO Company
Keir Desailly Today we are not going to explore malware or any other overtly malicious traffic. Instead this post is a warning about dishonest marketing tactics used…
Encrypted Cc.php with credit card stealing code
The Magento Shoplift vulnerability had been patched about a year ago. And all this time we have been cleaning various Magento infections that steal customer…
Security Advisory: Stored XSS in Magento
Marc-Alexandre Montpas During our regular research audits for our Cloud-based WAF, we discovered a Stored XSS vulnerability affecting the Magento platform that can be easily exploited remotely.…
Server Security: OSSEC Integrates Slack and PagerDuty
We leverage OSSEC extensively to help monitor and protect our servers. If you are not familiar with OSSEC, it is an open source Intrusion Detection System…
Ransomware Strikes Websites
Ben Martin Ransomware is one of the most insidious types of malware that one can come across. These infections will encrypt all files on the target computer…
Obfuscating display:none cloaking
We’ve seen lots of JavaScript tricks that hide injected spam from human visitors while making it look “visible” for search engines. The most popular approach…