Keylogger Found on Nearly 5,500 Infected WordPress Sites By Catalin Cimpanu

Solarquest

Moderator
MalwareTips Staff
AV-Tester
Joined
Jul 22, 2014
Messages
1,945
#1
Nearly 5,500 WordPress sites are infected with a malicious script that logs keystrokes and sometimes loads an in-browser cryptocurrency miner.

The malicious script is being loaded from the "cloudflare.solutions" domain, which is not affiliated with Cloudflare in any way, and logs anything that users type inside form fields as soon as the user switches away from an input field.

The script is loaded on both a site's frontend and backend, meaning it can also log usernames and passwords when logging into a site's admin panel.



The script is also dangerous when left to run on the frontend. While on most WordPress sites the only place it could steal user data is from comment fields, some WordPress sites are configured to run as online stores. In these instances, attackers can log credit card data and personal user details.

Most of these incidents occurred because hackers compromised WordPress sites through various means and hid the malicious script inside functions.php, a standard file found in all WordPress themes.

Attacker(s) has been active since April
....
...
...
Script active on nearly 5,500 WordPress sites
According to PublicWWW, this malicious script version is currently active on 5,496 sites, most ranked outside the Alexa Top 200,000.
...
 

upnorth

Level 21
Joined
Jul 27, 2015
Messages
1,084
#2
The fix from Sucuri is easy implemented.

Quote : " As we already mentioned, the malicious code resides in the function.php file of the WordPress theme. You should remove the add_js_scripts function and all the add_action clauses that mention add_js_scripts. Given the keylogger functionality of this malware, you should consider all WordPress passwords compromised so the next mandatory step of the cleanup is changing the passwords (actually it is highly recommended after any site hack). Don’t forget to check your site for other infections too. Many sites with the cloudflare.solutions malware also have injected coinhive cryptocurrency miner scripts. "

Source : Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites

Sucuri Hacked WordPress Cleanup Guide : Sucuri Security
 
Last edited: