W97M/Downloader Malware Dropper Served from Compromised Websites
Bruno Zanelato W97M/Downloader is part of a large banking malware operation that peaked in March 2016. Bad actors have been distributing this campaign for well over a…
Who is Responsible for the Security of Your Website?
Josh Hammer On a daily basis at Sucuri, we hear things like: “My host takes care of my website security.” “I have never been hacked, so why…
Hex’ing the CSS Style Attribute for Black Hat SEO
Ahmad Azizan Idris Dealing with Black Hat SEO injections on our daily operation is always fun and challenging at the same time. One day, we may work with…
Persistent Cross-site Scripting in WP Live Chat Support Plugin
John Castro During a routine research audits for our Sucuri Firewall, we discovered an Unauthenticated Persistent Cross-Site Scripting (XSS) affecting 60,000+ users of the WP Live Chat…
WordPress Plugin Give – Stored XSS for Donors
Antony Garand Give is a WordPress plugin which allows users to setup a donation page on a website. It currently has 60k installs. During a recent audit…
array_diff_ukey Usage in Malware Obfuscation
Luke Leal We discovered a PHP backdoor on a WordPress installation that contained some interesting obfuscation methods to keep it hidden from prying eyes: $zz1 = chr(95).chr(100).chr(101).chr(115).chr(116).chr(105).chr(110).chr(97).chr(116).chr(105).chr(111).chr(110);…
Multiple Vulnerabilities in the WordPress Ultimate Member Plugin
The Ultimate member plugin version 2.0.45 and lower is affected by multiple vulnerabilities, among them is a critical vulnerability allowing malicious users to read and…
New Guide on the Sucuri Referral Program
Chase Watts Referral programs and affiliate marketing opportunities can be found on many web-based company sites, however, often they’re overlooked. Commonly people consider these programs as something that…
Free Website Security Consultation for GoDaddy Pros
Alycia Mitchell Sucuri is partnering with GoDaddy Pro to make the internet more secure, one website professional at a time. Developers, designers, agencies, and freelancers now have…
Images Loading Credit Card Swipers
Denis Sinegubko We’ve come across an interesting approach to injecting credit card swipers into Magento web pages. Instead of injecting a real script, attackers insert a seemingly…
xmlrpc.php Brute Force Tool
We discovered a xmlrpc.php brute-force tool in a malicious PHP script that appears to have been uploaded months ago after a vulnerable GDPR plugin exploit:…