Online Services

eWorldLinx

Tag: WordPress Plugins

  • Google and Facebook Used in Phishing Campaigns

    Google and Facebook Used in Phishing Campaigns

    Google and Facebook Used in Phishing Campaigns

    We’ve all seen sketchy looking emails or texts with malicious links to click on. There are still people who fall for these more obvious types of scams, however, phishing scam messages are designed to be deceiving. They use methods that appear valid or of some urgent matter, encouraging its victim to hand over their data.

    Phishing Campaigns

    Phishing attempts happen in many ways, such as:

    • deceptive email campaigns,
    • suspicious SMS alerts (called smishing),
    • fake websites designed to look and sound authentic, and more.

    Continue reading Google and Facebook Used in Phishing Campaigns at Sucuri Blog.

  • Why You Should Care about Website Security on Your Small Site

    Why You Should Care about Website Security on Your Small Site

    Why You Should Care about Website Security on Your Small Site

    Most people assume that if their website has been compromised, there must have been an attacker evaluating their site and looking for a specific vulnerability to hack. Under most circumstances however, bad actors don’t manually hand-pick websites to attack since it’s a tedious and time consuming process. Instead, they rely on automation to identify vulnerable websites and execute their attacks.

    The unfortunate reality is that websites big or small are targeted daily and the majority of these attacks are automated.

    Continue reading Why You Should Care about Website Security on Your Small Site at Sucuri Blog.

  • Unwanted Ads via Baidu Links

    Unwanted Ads via Baidu Links

    Unwanted Ads via Baidu Links

    The malware attack that began as an installation of malicious Injectbody/Injectscr WordPress plugins back in February has evolved since then.

    Some of the changes were documented asUpdates at the bottom of the original blog post, however, every week we see minor modifications in the way they obfuscate the scripts or the files they inject them into.

    Encrypted WordPress JavaScript Files

    At this moment, the most common injection targets are core WordPress JavaScript files:

    wp-includes/js/jquery/jquery-migrate.min.js
    wp-includes/js/jquery/jquery.js
    wp-includes/js/wp-embed.min.js

    Hackers add the malicious code and then obfuscate the entire file contents along with the original legitimate code so that the only way to clean the files without breaking the site functionality is to replace them with their original clean copies.

    Continue reading Unwanted Ads via Baidu Links at Sucuri Blog.

  • Unwanted Pop-ups Caused by Injectbody/Injectscr Plugins

    Unwanted Pop-ups Caused by Injectbody/Injectscr Plugins

    Unwanted Pop-ups Caused by Injectbody/Injectscr Plugins

    On February 8th, 2018, we noticed a new wave of WordPress infections involving two malicious plugins: injectbody and injectscr. These plugins inject obfuscated scripts, creating unwanted pop-up/pop-unders. Whenever a visitor clicks anywhere on an infected web page, they are served questionable ads.

    Plugin Location

    The malicious plugins possess a very similar file structure:

    Injectbody

    wp-content/plugins/injectbody/

    • injectbody.php: 2146 bytes (the plugin code)
    • inject.txt: 2006 bytes (injected JavaScript)

    Injectscr

    wp-content/plugins/injectscr/

    • injectscr.php: 1319 bytes (the plugin code)
    • inject.txt: 3906 bytes (injected JavaScript)

    The functionality of these plugins are also very similar.

    Continue reading Unwanted Pop-ups Caused by Injectbody/Injectscr Plugins at Sucuri Blog.