More than 2,000 WordPress websites have Again been found infected using a piece of crypto-mining malware that will not only steals the resources of visitors’ computers to mine digital currencies however also logs visitors’ every keystroke.
Security researchers at Sucuri discovered a malicious campaign that will infects WordPress websites using a malicious script that will delivers an in-browser cryptocurrency miner via CoinHive along using a keylogger.
Sucuri researchers said the threat actors behind This specific completely new campaign is actually the same one who infected more than 5,400 WordPress websites last month since both campaigns used keylogger/cryptocurrency malware called cloudflare[.]solutions.
Spotted in April last year, Cloudflare[.]solutions is actually cryptocurrency mining malware along with is actually not at all related to network management along with cybersecurity firm Cloudflare. Since the malware used the cloudflare[.]solutions domain to initially spread the malware, the item has been given This specific name.
The malware was updated in November to include a keylogger. The keylogger behaves the same way as in previous campaigns along with can steal both the site’s administrator login page along with the website’s public facing frontend.
If the infected WordPress site is actually an e-commerce platform, hackers can steal much more valuable data, including payment card data. If hackers manage to steal the admin credentials, they can just log into the site without relying upon a flaw to break into the site.
The cloudflare[.]solutions domain was taken down last month, however criminals behind the campaign registered completely new domains to host their malicious scripts that will are eventually loaded onto WordPress sites.
The completely new web domains registered by hackers include cdjs[.]online (registered on December 8th), cdns[.]ws (on December 9th), along with msdns[.]online (on December 16th).
Just like from the previous cloudflare[.]solutions campaign, the cdjs[.]online script is actually injected into either a WordPress database or the theme’s functions.php file. The cdns[.]ws along with msdns[.]online scripts are also found injected into the theme’s functions.php file.
The number of infected sites for cdns[.]ws domain include some 129 websites, along with 103 websites for cdjs[.]online, according to source-code search engine PublicWWW, though over a thousand sites were reported to have been infected by the msdns[.]online domain.
Researchers said the item’s likely that will the majority of the websites have not been indexed yet.
“While these completely new attacks do not yet appear to be as massive as the original Cloudflare[.]solutions campaign, the reinfection rate shows that will there are still many sites that will have failed to properly protect themselves after the original infection. the item’s possible that will some of these websites didn’t even notice the original infection,” Sucuri researchers concluded.
If your website has already been compromised with This specific infection, you will require to remove the malicious code via theme’s functions.php along with scan wp_posts table for any possible injection.
Users are advised to change all WordPress passwords along with update all server software including third-party themes along with plugins just to be on the safer side.