Understanding & Stopping Malicious Redirects
Art Martori Many website owners don’t know they’re infected with malicious redirects until they start getting calls from wary customers. Instead of the site they were expecting,…
Steam Phishing Campaign Uses CS:GO Skin Gambling Lure
Luke Leal Attackers regularly target online gaming accounts as they can quickly sell any transferable items along with account logins to a third party. This scenario has…
What is FTP? Why use it to clean hacked websites?
Juliana Lewis The File Transfer Protocol (FTP) is a network protocol used to transfer files between a client server and a network. In other words, it is…
WordPress Malware Collects Sensitive WooCommerce Data
During a recent investigation, our team found malicious code that reveals how attackers are performing reconnaissance to identify if sites are actively using WooCommerce in…
Unauthenticated Stored Cross Site Scripting in WP Product Review
John Castro During a routine research audit for our Sucuri Firewall, we discovered an Unauthenticated Persistent Cross-Site Scripting (XSS) affecting 40,000+ users of the WP Product Review…
B374k Web Shell Packer
PHP web shells are a type of backdoor which, when left on compromised websites, allow attackers to maintain unauthorized access after initial compromise. To further…
YouTube Account Recovery Phishing
Phishing attacks against targeted channels have been successful in the past, as explained last year on ZDNet. Recently, our Remediation team found an interesting phishing…
New Drupal Website Security Best Practices Guide
Justin Channell When it comes to content management systems (CMS) for websites, Drupal is a highly flexible and extendible open-source solution. It is often preferred by technical…
Labs Notes Monthly Recap – April/2020
In 2020, we doubled up our research efforts to report on many new attacks and hacks that we see in the wild. We believe that…
Vulnerabilities Digest: April 2020
Relevant Plugins and Vulnerabilities: Plugin Vulnerability Patched Version Installs Widget Settings Importer/Exporter Stored XSS Closed 40000 Accordion Stored/Reflected XSS 2.2.9 30000 Support Ticket System By…
Phishing Campaign Targets Poste Italiane & SMS OTP Verification
When creating phishing lures, attackers may cite recent major regulatory changes within the context of their social engineering scheme to confuse or further entice victims…