The Strange Case of the Malicious Favicon
Néstor Angulo During the past year, our Remediation department has seen a large increase in the number of fully spammed sites. The common factors are strangely named…
Stolen Payment Data: Infected Ecommerce Website to Darknet Markets
Luke Leal The final actor of the stolen payment data supply chain is the end user. Rather than just selling or reselling payment data, the end user…
The Cost of a Hacked Website – Survey
Pilar Garcia As part of our commitment to the website security community, we want to know the true impacts of a website compromise from the owner’s perspective.…
WPTF Hybrid Composer – Unauthenticated Arbitrary Options Update
John Castro With almost 300 installs, WPTF – Hybrid Composer is a framework that helps users easily create custom themes for WordPress. We recently noticed an increase…
Magento Killer
A malicious PHP script, aptly given the name “Magento Killer” by its creator(s), has been found targeting Magento websites. While it doesn’t actually kill the…
Icegram Persistent Cross-Site Scripting
Icegram is a plugin that helps you collect email addresses for your newsletter. Other features include light-box popup offers, header action bars, toast notifications, and…
7 Things You Should Monitor in WordPress Activity Logs
Victor Santoyo WordPress activity logs can be helpful when troubleshooting or trying to identify a hack. In this article, you’ll learn about the seven things you should…
Spam That Fits Your Website
Gabriel Barbosa Most of the time when we talk about spam, we think about mindless machines that create posts or comments to advertise a business related to…
WordPress Plugin WP Statistics: Unauthenticated Stored XSS Under Certain Configurations
Antony Garand The WordPress plugin WP Statistics, which has an active installation base of 500k users, has an unauthenticated stored XSS vulnerability on versions prior to 12.6.7.…
How to Know If You Are Under DDoS Attack
Stephen Johnston Nowadays, DDoS is a pretty recognizable term. Though many webmasters don’t know exactly what a DDoS attack is—its method is very subtle to identify—they’re pretty…
Massive 1800ForBail WordPress Hacks
Denis Sinegubko Sucuri malware analyst Kaushal Bhavsar recently brought our attention to a massive campaign responsible for adding either “1800ForBail” or “1800ForBail – One+Number” keywords to the…