How to Improve Your Website Security Posture – Part II
AJ Syed Ali In the first post of this series, we discussed some of the main website security threats. Knowing the website security environment is a vital part…
Core Integrity Verifications
Gerson Ruiz In order to clean a malware infection, the first thing we need to know is which files have been compromised. At Sucuri, we use several…
Fake Font Dropper
Moe O Every day we see different website infections. When we receive unusual or interesting cases, our researcher instincts are triggered to investigate the unusual website behavior…
Massive WordPress Redirect Campaign Targets Vulnerable tagDiv Themes and Ultimate Member Plugins
Denis Sinegubko This August, we’ve seen a new massive wave of WordPress infections that redirect visitors to unwanted sites. When redirected, users see annoying pages with random…
Fake Plugins with Popuplink.js Redirect to Scam Sites
Since July, we’ve been observing a massive WordPress infection that is responsible for unwanted redirects to scam and ad sites. This infection involves the tiny.cc…
How to Improve Your Website Security Posture – Part I
Have you ever wondered if your website security posture is adequate enough? The risk of having a website compromise is never going to be zero.…
How to Improve Website Resilience for DDoS Attacks – Part II – Caching
Northon Torga In the first post of this series, we talked about the practices that will optimize your site and increase your website’s resilience to DDoS attacks.…
Fake Cloudflare Injection
Fioravante Souza Seeing malicious campaigns using domain names that resemble big market players is not news anymore. This time I\’ll talk about the new redirects of cloudflare.pw.****…
Cookie Consent Script Used to Distribute Malware
Krasimir Konov Most websites today use cookies. Since May 25th, 2018, all websites that do business in the European Union (EU) had to make some changes to…
Cryptominers: Binary-Process-Cron Variants and Methods of Removal
Tyler Lancy This post provides a brief overview of how to manually remove server-side cryptominers and other types of Binary-Process-Cron malware from a server. Unlike browser-based JavaScript…
Obfuscated JavaScript Crypto Miner
Samuel Odendaal During an incident response investigation, we detected an interesting piece of heavily obfuscated JavaScript malware. Once decoded, Crypto Miners were ran on customers visiting the…