Wikipedia Page Review Reveals Minr Malware
Denis Sinegubko Since December, we’ve seen a number of websites with this funny looking obfuscated script injected at the very top of the HTML code (before the…
Unwanted Pop-ups Caused by Injectbody/Injectscr Plugins
On February 8th, 2018, we noticed a new wave of WordPress infections involving two malicious plugins: injectbody and injectscr. These plugins inject obfuscated scripts, creating…
Sucuri Website Backups Product Update
Jonas Andrijauskas We’re excited to be sharing some changes we’ve recently pushed for our Website Backups product. If you’re not familiar with this feature, Sucuri Website Backups…
How to Add Security to Your Client’s Websites
Juliana Lewis Website security has crossed the mind of nearly every website owner. However, as a website security company, we know that most webmasters come to us…
What is a WAF?
Have you ever wondered what WAF means? WAF stands for Website Application Firewall. In order to make it simple to understand, imagine your website as…
Cloudflare[.]solutions Keylogger Returns on New Domains
A few months ago, we covered two injections related to the “cloudflare.solutions” malware: a CoinHive cryptominer hidden within fake Google Analytics and jQuery, and the…
Server-level Cryptominer Injections
Cesar Anjos During an investigation on a recent case, we came across a malware infection that came directly from the server. Upon further inspection, we found that…
SQLi Vulnerability in YITH WooCommerce Wishlist
John Castro As part of our regular research audits for our Sucuri Firewall, we discovered an SQL Injection vulnerability affecting the YITH WooCommerce Wishlist plugin for WordPress.…
Malicious Website Cryptominers from GitHub. Part 2.
Recently we wrote about how GitHub/GitHub.io was used in attacks that injected cryptocurrency miners into compromised websites. Around the same time, we noticed another attack…
Reverse Javascript Injection Redirects to Support Scam on WordPress
Ben Martin Over the last few weeks, we’ve noticed a JavaScript injection in a number of WordPress databases, and we recently wrote about them in a Sucuri…
Naive CoinHive Injections
Since CoinHive domain made it into many blacklists, attackers began avoiding linking to the hosted library file https://coinhive .com/lib/coinhive.min.js. Instead, they uploaded this file to…