WordPress Database Brute Force and Backdoors
Denis Sinegubko We regularly talk about brute force attacks on WordPress sites and explain why WordPress credentials should always be unique, complex, and hard to guess. However,…
3-D Secure SMS-OTP Phishing
Luke Leal One of our remediation analysts Eli Trevino recently discovered a phishing page informing victims about fake Netflix service disruptions, supposedly due to problems with the…
Phishing and Malware via SMS Text Message
Krasimir Konov We’ve recently noticed an increase in reports of phishing and malware being distributed via SMS text messages. During one investigation, we identified fake messages sent…
PCI Compliance, Penetration Testing, and the Sucuri WAF
Marc Kranat Our support team is often asked, “Can we test our site through the Sucuri Web Application Firewall?” The answer is always yes, with a caveat.…
Let’s Encrypt Revokes 3 Million Certificates Due to CAA Bug
Northon Torga Imagine receiving a TLS warning on your browser every time you visit your website for 60 days straight. Definitely not an ideal situation and you…
Vulnerabilities Digest: February 2020
John Castro Fixed Plugins and Vulnerabilities Plugin Vulnerability Patched Version Installs Duplicator Arbitrary File Download 1.3.28 1000000 Modula Image Gallery Authenticated Stored XSS 2.2.5 70000 Easy Property…
7 Tips for Protecting Your Website
Art Martori For many people, website security is an intimidating topic. It seems like there’s an endless list of things necessary for protecting your website. And while…
Skimmer Plugin Hides Itself From wp-admin
Our analyst Moe O recently discovered an interesting Javascript injection that was stealing submitted payment data from visitors on a WordPress website with a Woocommerce…
What is Pharma Hack Spam?
Have you ever seen a website advertising products that seem unrelated to the apparent purpose of the site? Often, this suspicious content is promising pharmacy…
Malicious WordPress User Hijacker
Our analyst Liam Smith recently found a malicious file with the name wp-atom2.php on a compromised WordPress site that had been infected with pharma spam.…
Magento Login Stealer in Fake bg_white.png Image
Our Remediation team analyst Ben Martin recently found a malicious injection in a compromised Magento 1.9.x installation that was stealing Magento user login credentials. The…