Keylogger Found on Nearly 5,500 Infected WordPress Sites By Catalin Cimpanu

Discussion in 'News Archive' started by Solarquest, Dec 6, 2017.

  1. Solarquest

    Solarquest Moderator
    Staff Member AV Tester

    Jul 22, 2014
    Nearly 5,500 WordPress sites are infected with a malicious script that logs keystrokes and sometimes loads an in-browser cryptocurrency miner.

    The malicious script is being loaded from the "" domain, which is not affiliated with Cloudflare in any way, and logs anything that users type inside form fields as soon as the user switches away from an input field.

    The script is loaded on both a site's frontend and backend, meaning it can also log usernames and passwords when logging into a site's admin panel.


    The script is also dangerous when left to run on the frontend. While on most WordPress sites the only place it could steal user data is from comment fields, some WordPress sites are configured to run as online stores. In these instances, attackers can log credit card data and personal user details.

    Most of these incidents occurred because hackers compromised WordPress sites through various means and hid the malicious script inside functions.php, a standard file found in all WordPress themes.

    Attacker(s) has been active since April
    Script active on nearly 5,500 WordPress sites
    According to PublicWWW, this malicious script version is currently active on 5,496 sites, most ranked outside the Alexa Top 200,000.
  2. upnorth

    upnorth Level 14

    Jul 27, 2015
    #2 upnorth, Dec 7, 2017
    Last edited: Dec 7, 2017
    The fix from Sucuri is easy implemented.

    Quote : " As we already mentioned, the malicious code resides in the function.php file of the WordPress theme. You should remove the add_js_scripts function and all the add_action clauses that mention add_js_scripts. Given the keylogger functionality of this malware, you should consider all WordPress passwords compromised so the next mandatory step of the cleanup is changing the passwords (actually it is highly recommended after any site hack). Don’t forget to check your site for other infections too. Many sites with the malware also have injected coinhive cryptocurrency miner scripts. "

    Source : Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites

    Sucuri Hacked WordPress Cleanup Guide : Sucuri Security
  3. shmu26

    shmu26 Level 57

    Jul 3, 2015
    Windows 10
    Could a user have protected himself?
    It sounds like the keylogging was an in-browser process, so normal default/deny solutions would not help, correct?
  • About Us

    Our community has been around since 2010, and we pride ourselves on offering unbiased, critical discussion among people of all different backgrounds about security and technology . We are working every day to make sure our community is one of the best.
  • Need Malware Removal Help?

    If you're being redirected from a site you’re trying to visit, seeing constant pop-up ads, unwanted toolbars or strange search results, your computer may be infected with malware. We offer free malware removal assistance to our members in the Malware Removal Assistance forum.
  • Quick Tip

    Without meaning to, you may click a link that installs malware on your computer. To keep your computer safe, only click links and downloads from sites that you trust. Don’t open any unknown file types, or download programs from pop-ups that appear in your browser.