Keylogger Found on Nearly 5,500 Infected WordPress Sites By Catalin Cimpanu

Discussion in 'Security News' started by Solarquest, Dec 6, 2017.

  1. Solarquest

    Solarquest Moderator
    Staff Member AV Tester

    Jul 22, 2014
    Nearly 5,500 WordPress sites are infected with a malicious script that logs keystrokes and sometimes loads an in-browser cryptocurrency miner.

    The malicious script is being loaded from the "" domain, which is not affiliated with Cloudflare in any way, and logs anything that users type inside form fields as soon as the user switches away from an input field.

    The script is loaded on both a site's frontend and backend, meaning it can also log usernames and passwords when logging into a site's admin panel.


    The script is also dangerous when left to run on the frontend. While on most WordPress sites the only place it could steal user data is from comment fields, some WordPress sites are configured to run as online stores. In these instances, attackers can log credit card data and personal user details.

    Most of these incidents occurred because hackers compromised WordPress sites through various means and hid the malicious script inside functions.php, a standard file found in all WordPress themes.

    Attacker(s) has been active since April
    Script active on nearly 5,500 WordPress sites
    According to PublicWWW, this malicious script version is currently active on 5,496 sites, most ranked outside the Alexa Top 200,000.
  2. upnorth

    upnorth Level 10

    Jul 27, 2015
    #2 upnorth, Dec 7, 2017
    Last edited: Dec 7, 2017
    The fix from Sucuri is easy implemented.

    Quote : " As we already mentioned, the malicious code resides in the function.php file of the WordPress theme. You should remove the add_js_scripts function and all the add_action clauses that mention add_js_scripts. Given the keylogger functionality of this malware, you should consider all WordPress passwords compromised so the next mandatory step of the cleanup is changing the passwords (actually it is highly recommended after any site hack). Don’t forget to check your site for other infections too. Many sites with the malware also have injected coinhive cryptocurrency miner scripts. "

    Source : Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites

    Sucuri Hacked WordPress Cleanup Guide : Sucuri Security
  3. shmu26

    shmu26 Level 51

    Jul 3, 2015
    above water
    Could a user have protected himself?
    It sounds like the keylogging was an in-browser process, so normal default/deny solutions would not help, correct?
Similar Threads Forum Date
Keylogger Found in HP Notebook Keyboard Driver By Security News Friday at 2:53 PM
Security Alert Keylogger Found in Audio Driver of HP Laptops Security News May 11, 2017
Malware Analysis Trojan.Keylogger (keylogger analysis) Malware Analysis Nov 13, 2017