Joomla Security – Pornography Spam Campaign in the Wild
Bruno Zanelato One of the worst experiences for a website owner is finding out that the search results for your site have turned into a pharmacy, a…
WordPress Security – Fake TrafficAnalytics Website Infection
Rodrigo Escobar Several months ago, our research team identified a fake analytics infection, known as RealStatistics. The malicious Javascript injection looks a lot like tracking code for…
.user.ini SPAM SEO Redirect
John Castro Since PHP 5.3.0, PHP includes support for configuration INI files on a per-directory basis that has the same effect (depending on the case) that the…
Backdooring sites using exotic php functions
Throughout the last few months, we published multiple articles about simple but powerful backdoors and how attackers get creative. Virtually in all cases, the code…
New Guide on How to Fix Hacked Magento Sites
Alycia Mitchell Ecommerce refers to websites that involve online purchases. This functionality sparks new challenges, concerns, and requirements for website security. Online shopping, to many people, is…
Labs Notes Monthly Recap – Jan/2017
Estevao Avillez Every month we recap the latest posts on Sucuri Labs, written by our Malware Research Team (MRT) and Incident Response Teams (IRT). The Sucuri Labs…
Hiding malicious code from the user using white spaces
Yuliyan Tsvetkov Over the years, attackers have used different techniques for hiding malicious files on websites. They obfuscated code, changed legit functions to execute malware, modified whole…
RCE Attempts Against the Latest WordPress REST API Vulnerability
Daniel Cid We are starting to see remote command execution (RCE) attempts trying to exploit the latest WordPress REST API Vulnerability. These RCE attempts started today after…
JavaScript Injections Leads to Tech Support Scam
Krasimir Konov During a recent malware investigation, we found some interesting obfuscated Javascript code. This code pretends to appear as part of the popular AddThis social sharing…
Checking blacklisted domains or IP for spamming
Luke Leal Often times we will encounter websites that have been injected with a redirect and these can vary from blackhat SEO tactics for boosting domain rankings…
WordPress REST API Vulnerability Abused in Defacement Campaigns
WordPress 4.7.2 was released two weeks ago, including a fix for a severe vulnerability in the WordPress REST API. We have been monitoring our WAF…