SecuriTricks - wordpress

Stealthy Credit Card Skimmer Targets WordPress Checkout Pages via Database Injection

A sophisticated credit card skimmer malware has been discovered targeting WordPress websites. The malware injects malicious JavaScript into database entries, specifically in the wp_options table, to steal sensitive payment details from checkout pages. It activates only on checkout pages, either hij…

wordpress

credit card skimmer

ecommerce

2025-01-10

database injection

Published: January 10, 2025

Downloadable IOCs: 0

PHP Reinfector and Backdoor Malware Target WordPress Sites

A sophisticated PHP reinfector and backdoor malware is targeting WordPress websites, infecting plugin files and database tables. The malware reinfects active plugins, manipulates wp_options and wp_posts tables, and creates malicious admin users. It utilizes WordPress's cron system to maintain contr…

database manipulation

Published: November 14, 2024

Downloadable IOCs: 0

AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services

The AndroxGh0st malware has expanded its capabilities by incorporating the Mozi botnet to target IoT devices and cloud services. This Python-based tool, known for attacking Laravel applications, now exploits a wider range of vulnerabilities in internet-facing applications. The malware uses remote c…

remote code execution

Published: November 8, 2024

Downloadable IOCs: 1

2024 Credit Card Theft Season Arrives

As the holiday shopping season approaches, eCommerce website owners need to be vigilant against credit card stealing malware, known as 'MageCart'. Attackers focus their efforts in the last quarter to maximize profits from stolen card details. Analysis of recent malware samples reveals sophisticated…

holiday shopping season

r.blob skimmer

ecommerce security

Published: November 7, 2024

Downloadable IOCs: 0

DarkCracks, an advanced malicious payload & upgrade framework utilizing hacked GLPI and WordPress sites as intermediaries

DarkCracks is a sophisticated malware framework that exploits compromised GLPI and WordPress sites as intermediaries for payload delivery and command and control. It collects sensitive information from infected devices, maintains long-term access, and uses them as nodes to control other devices or …

infrastructure compromise

glpi

Published: September 4, 2024

Downloadable IOCs: 55

Fake update puts visitors at risk

This intelligence report discusses SocGholish, a JavaScript downloader used by threat actors to deliver malware payloads disguised as fake browser updates. It analyzes the recent tactics, techniques, and procedures employed by threat groups like Evil Corp in compromising WordPress websites, fingerp…

Published: July 24, 2024

Downloadable IOCs: 10

Supposed Grasshopper: operators impersonate Israeli government and private companies to deploy open-source malware

A long-running campaign was identified involving malicious actors impersonating Israeli entities and private companies. The operators delivered payloads through crafted WordPress sites, employing a mix of custom code and open-source malware like Donut and Sliver. While the motivations remain unclea…

Published: June 28, 2024

Downloadable IOCs: 18

Active exploitation of stored XSS vulnerabilities in WordPress Plugins

Recent months have witnessed active exploitation attempts targeting multiple cross-site scripting (XSS) vulnerabilities in popular WordPress plugins. The attacks involve injecting malicious scripts that create new admin accounts, install backdoors, and implement tracking mechanisms. The affected pl…

Published: May 31, 2024

Linked vulnerabilities : CVE-2023-6961 (CVSS 7.2), CVE-2023-40000, CVE-2024-2194

Downloadable IOCs: 28

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin

A recent surge of malicious JavaScript code has been observed targeting websites using vulnerable versions of the LiteSpeed Cache plugin for WordPress. The malware injects code into critical WordPress files or the database, creating unauthorized admin users like 'wpsupp-user.' It exploits the vulne…

Published: May 9, 2024

Downloadable IOCs: 6

Tag: wordpress

Attack reports

Stripe API Skimming Campaign: Additional Victims & Insights

Fake Cloudflare Verification Results in LummaStealer Trojan Infections

Credit Card Skimmer and Backdoor on WordPress E-commerce Site

Cascading Redirects: Unmasking a Multi-Site JavaScript Malware Campaign

Fake WordPress Plugin Impacts SEO by Injecting Casino Spam

Stealthy Credit Card Skimmer Targets WordPress Checkout Pages via Database Injection

PHP Reinfector and Backdoor Malware Target WordPress Sites

AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services

2024 Credit Card Theft Season Arrives

DarkCracks, an advanced malicious payload & upgrade framework utilizing hacked GLPI and WordPress sites as intermediaries

Fake update puts visitors at risk

Supposed Grasshopper: operators impersonate Israeli government and private companies to deploy open-source malware

Active exploitation of stored XSS vulnerabilities in WordPress Plugins

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin