Online Services

eWorldLinx

Tag: Website Security

  • WordPress Database Upgrade Phishing Campaign

    WordPress Database Upgrade Phishing Campaign

    WordPress Database Upgrade Phishing Campaign

    We have recently been notified of phishing emails that target WordPress users. The content informs site owners that their database requires an update and looks like this:

    The email’s appearance resembles that of a legitimate WordPress update message, however the content includes typos and uses an older messaging style. Another suspicious item in the content is the deadline. WordPress wouldn’t define deadlines without a valid explanation, and hosting providers wouldn’t either (if you believed the email was from them).

    Continue reading WordPress Database Upgrade Phishing Campaign at Sucuri Blog.

  • Core Integrity Verifications

    Core Integrity Verifications

    Core Integrity Verifications

    In order to clean a malware infection, the first thing we need to know is which files have been compromised. At Sucuri, we use several techniques including whitelists, blacklists, and anomaly checks. In this blog post, we’re going to be focusing on how core integrity checks are a key component of the whitelisting model and how this is aids in effectively detecting malware.

    Cryptographic Hash Functions and Checksums

    When a website compromise happens, attackers add, modify, or delete files from the server.

    Continue reading Core Integrity Verifications at Sucuri Blog.

  • Fake Font Dropper

    Fake Font Dropper

    Fake Font Dropper

    Every day we see different website infections. When we receive unusual or interesting cases, our researcher instincts are triggered to investigate the unusual website behavior in order to understand how new infections work. In this case, the odd behavior was the website’s pop-up window claiming there was a missing font.

    The Unwanted Popup Window

    A website owner reached out to us to investigate the error displaying on their site. The popup window informed the visitors that they were unable to view the content of the site because their computers were missing a font called “HoeflerText”:

    The malware tries to trick visitors into clicking the “Update” button to download a malicious file called: Font_Update.exe

    Earlier this year, we wrote about a wave of WordPress infections involving malicious plugins that inject obfuscated scripts, creating unwanted pop-up/pop-unders which serve unwanted ads.

    Continue reading Fake Font Dropper at Sucuri Blog.

  • Massive WordPress Redirect Campaign Targets Vulnerable tagDiv Themes and Ultimate Member Plugins

    Massive WordPress Redirect Campaign Targets Vulnerable tagDiv Themes and Ultimate Member Plugins

    Massive WordPress Redirect Campaign Targets Vulnerable tagDiv Themes and Ultimate Member Plugins

    This August, we’ve seen a new massive wave of WordPress infections that redirect visitors to unwanted sites.

    When redirected, users see annoying pages with random utroro[.]com addresses and fake reCAPTCHA images. The messages and content try to convince visitors to verify and subscribe to browser notifications without disclosing the purpose of this behavior.

    Alternative redirect URLs include:

    hxxp://murieh[.]space/?h=930130016_dc950a456f7_100&h_l=&h_5=sub_id_2&h_2=def_sub

    hxxps://unverf[.]com/?h=930130016_dc950a456f7_100&h_l=&h_5=sub_id_2&h_2=def_sub
    Injected Scripts

    The injected malware involves a script from one of the following two sites: cdn.eeduelements[.]com and cdn.allyouwant[.]online.

    Continue reading Massive WordPress Redirect Campaign Targets Vulnerable tagDiv Themes and Ultimate Member Plugins at Sucuri Blog.