Security Advisory: Stored XSS in Jetpack
Marc-Alexandre Montpas During a routine audit for our WAF, we discovered a critical stored XSS affecting the Jetpack WordPress plugin, one of the most popular plugins in…
FormCraft v1.4.6 under attack
Denis Sinegubko As we clean many sites infected by the VisitorTracker malware, we see vulnerabilities in multiple plugins being exploited by attackers. For example, my colleagues John…
WordPress Malware – VisitorTracker Campaign Update
Daniel Cid For the last 3 weeks we have been tracking a malware campaign that has been compromising thousands of WordPress sites with the VisitorTracker malware code.…
Analyzing Black Hat URL Shorteners
Hackers are known to use URL shortening services to obfuscate their real landing pages. It’s very effective in clickbait scams on social networks. Some hackers…
Minimalistic WordPress injection
WordPress-specific malware is slightly different than generic PHP malware. Inside WordPress files, it can use WordPress API and WordPress database. This allows to create this…
.htaccess Tricks in Global.asa Files
As you might know a lot of hacks use Apache configuration .htaccess files to override default web site behavior: add conditional redirects, create virtual paths…
Yet another spam mailer
Krasimir Konov Here is a mailer script we recently found that appears to be designed to send spam emails. These kind of scripts are pretty common, there…
WordPress Malware – Active VisitorTracker Campaign
We are seeing a large number of WordPress sites compromised with the “visitorTracker_isMob” malware code. This campaign started 15 days ago, but only in the…
Analyzing Proxy Based Spam Networks
Tony Perez We are no strangers to Blackhat SEO techniques, we’ve actually spent a great deal of time working and sharing various bits of information related to…
WordPress Brute Force Attacks – 2015 Threat Landscape
One of the first server-level compromises I had to deal with in my life was around 15 years ago, and it was caused by an…
Magento script stealing credit card details
We recently found another malicious script used to steal credit cards that appears to be injected into compromised websites running Magento, it appears to be…