Rise in WordPress Hacks: Cybercriminals Mask Theft as Image Downloads

 

 

 More than five thousand web resources have already been hit by a new large-scale campaign.

 

 

 

 

A malicious campaign has been identified on more than 5,000 WordPress sites, during which attackers create fake administrator accounts, install malicious plugins, and steal data. Specialists at c/side, a web script security company, detected this activity during the incident response of one of the customers.

Malicious activity uses the wp3[.] domainxyz for data transfer. The original infection vector has not yet been established. After the site is compromised, a malicious script from the specified domain creates an administrator account named wpx_admin, and its data is stored in the code.

The script then downloads and activates a malicious plugin called plugin.php from the same domain. According to c/side, this plugin is designed to collect sensitive information, including administrator credentials and logs, which are sent to the attackers' server. The data transfer is disguised as a request for images.

The attack includes verification mechanisms, such as recording the status after creating an account and confirming the installation of the plugin.

To prevent such attacks, c/side experts recommend:

• Block wp3 domain[.]xyz with firewalls and security tools.
  
•  Check all privileged accounts and installed plugins, removing suspicious items.
• Strengthen protection against CSRF attacks using unique tokens, server-side validation, and their periodic regeneration. Tokens must have a time limit.
• Set up multi-factor authentication to protect accounts with already compromised data.

Mass attacks on WordPress sites highlight the importance of regular security checks and proactive protection. Ignoring these measures can cost sensitive data and control over the resource. 

Don't let technological challenges hold you back. Take advantage of Redfish-IA VEN expertise and reliable support to keep your business thriving. Contact us today to schedule a consultation and experience the difference that top-notch IT services can make!

Website: https://redfishiaven.tech/                                                                                                  Phone: [+233-541-625-812]
Email: redfishiaven@proton.me
Don't let your computers "sink" - let Redfish-IA VEN keep you afloat!