Rise in WordPress Hacks: Cybercriminals Mask Theft as Image Downloads
More than five thousand web resources have already been hit by a new large-scale campaign. A malicious campaign has been identified on more than 5,000 WordPress sites, during which attackers create fake administrator accounts, install malicious plugins, and steal data. Specialists at c/side, a web script security company, detected this activity during the incident response of one of the customers. Malicious activity uses the wp3[.] domainxyz for data transfer. The original infection vector has not yet been established. After the site is compromised, a malicious script from the specified domain creates an administrator account named wpx_admin, and its data is stored in the code. The script then downloads and activates a malicious plugin called plugin.php from the same domain. According to c/side, this plugin is designed to collect sensitive information, including administrator credentials and logs, which are sen...
