Keylogger Found on Nearly 5,500 Infected WordPress Sites By Catalin Cimpanu

[Solarquest]

Nearly 5,500 WordPress sites are infected with a malicious script that logs keystrokes and sometimes loads an in-browser cryptocurrency miner.

The malicious script is being loaded from the "cloudflare.solutions" domain, which is not affiliated with Cloudflare in any way, and logs anything that users type inside form fields as soon as the user switches away from an input field.

The script is loaded on both a site's frontend and backend, meaning it can also log usernames and passwords when logging into a site's admin panel.

The script is also dangerous when left to run on the frontend. While on most WordPress sites the only place it could steal user data is from comment fields, some WordPress sites are configured to run as online stores. In these instances, attackers can log credit card data and personal user details.

Most of these incidents occurred because hackers compromised WordPress sites through various means and hid the malicious script inside functions.php, a standard file found in all WordPress themes.

Attacker(s) has been active since April
....
...
...
Script active on nearly 5,500 WordPress sites
According to PublicWWW, this malicious script version is currently active on 5,496 sites, most ranked outside the Alexa Top 200,000.
...

 

[upnorth]

The fix from Sucuri is easy implemented.

Quote : " As we already mentioned, the malicious code resides in the function.php file of the WordPress theme. You should remove the add_js_scripts function and all the add_action clauses that mention add_js_scripts. Given the keylogger functionality of this malware, you should consider all WordPress passwords compromised so the next mandatory step of the cleanup is changing the passwords (actually it is highly recommended after any site hack). Don’t forget to check your site for other infections too. Many sites with the cloudflare.solutions malware also have injected coinhive cryptocurrency miner scripts. "

Source : Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites

Sucuri Hacked WordPress Cleanup Guide : Sucuri Security

 

[shmu26]

Could a user have protected himself?
It sounds like the keylogging was an in-browser process, so normal default/deny solutions would not help, correct?