SecuriTricks - wordpress

The Rise of Online Casino Spam

This analysis explores the growing prevalence of online casino spam, particularly targeting WordPress websites. The report details a sophisticated malware infection that employs multiple layers of redundancy and reinfection mechanisms. The malware injects spam content into existing pages, stores pa…

malware

spam

Published: November 7, 2025

Downloadable IOCs: 0

Attackers Actively Exploiting Critical Vulnerability in Service Finder Bookings Plugin

On June 8th, 2025, we received a submission through our Bug Bounty Program for an Authentication Bypass vulnerability in Service Finder Bookings, a WordPress plugin bundled with the Service Finder theme. This theme has been sold to approximately 6,000 customers. This vulnerability makes it possible…

exploit

vulnerability

wordpress

authentication bypass

2025-10-09

wordfence

service finder bookings

service finder

Published: October 9, 2025

Downloadable IOCs: 5

Stealthy Credit Card Skimmer Targets WordPress Checkout Pages via Database Injection

A sophisticated credit card skimmer malware has been discovered targeting WordPress websites. The malware injects malicious JavaScript into database entries, specifically in the wp_options table, to steal sensitive payment details from checkout pages. It activates only on checkout pages, either hij…

Published: January 10, 2025

Downloadable IOCs: 0

PHP Reinfector and Backdoor Malware Target WordPress Sites

A sophisticated PHP reinfector and backdoor malware is targeting WordPress websites, infecting plugin files and database tables. The malware reinfects active plugins, manipulates wp_options and wp_posts tables, and creates malicious admin users. It utilizes WordPress's cron system to maintain contr…

database manipulation

Published: November 14, 2024

Downloadable IOCs: 0

AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services

The AndroxGh0st malware has expanded its capabilities by incorporating the Mozi botnet to target IoT devices and cloud services. This Python-based tool, known for attacking Laravel applications, now exploits a wider range of vulnerabilities in internet-facing applications. The malware uses remote c…

remote code execution

Published: November 8, 2024

Downloadable IOCs: 1

2024 Credit Card Theft Season Arrives

As the holiday shopping season approaches, eCommerce website owners need to be vigilant against credit card stealing malware, known as 'MageCart'. Attackers focus their efforts in the last quarter to maximize profits from stolen card details. Analysis of recent malware samples reveals sophisticated…

holiday shopping season

r.blob skimmer

ecommerce security

Published: November 7, 2024

Downloadable IOCs: 0

DarkCracks, an advanced malicious payload & upgrade framework utilizing hacked GLPI and WordPress sites as intermediaries

DarkCracks is a sophisticated malware framework that exploits compromised GLPI and WordPress sites as intermediaries for payload delivery and command and control. It collects sensitive information from infected devices, maintains long-term access, and uses them as nodes to control other devices or …

infrastructure compromise

glpi

Published: September 4, 2024

Downloadable IOCs: 55

Fake update puts visitors at risk

This intelligence report discusses SocGholish, a JavaScript downloader used by threat actors to deliver malware payloads disguised as fake browser updates. It analyzes the recent tactics, techniques, and procedures employed by threat groups like Evil Corp in compromising WordPress websites, fingerp…

Published: July 24, 2024

Downloadable IOCs: 10

Supposed Grasshopper: operators impersonate Israeli government and private companies to deploy open-source malware

A long-running campaign was identified involving malicious actors impersonating Israeli entities and private companies. The operators delivered payloads through crafted WordPress sites, employing a mix of custom code and open-source malware like Donut and Sliver. While the motivations remain unclea…

Published: June 28, 2024

Downloadable IOCs: 18

Active exploitation of stored XSS vulnerabilities in WordPress Plugins

Recent months have witnessed active exploitation attempts targeting multiple cross-site scripting (XSS) vulnerabilities in popular WordPress plugins. The attacks involve injecting malicious scripts that create new admin accounts, install backdoors, and implement tracking mechanisms. The affected pl…

Published: May 31, 2024

Linked vulnerabilities : CVE-2023-6961 (CVSS 7.2), CVE-2023-40000, CVE-2024-2194

Downloadable IOCs: 28

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin

A recent surge of malicious JavaScript code has been observed targeting websites using vulnerable versions of the LiteSpeed Cache plugin for WordPress. The malware injects code into critical WordPress files or the database, creating unauthorized admin users like 'wpsupp-user.' It exploits the vulne…

Published: May 9, 2024

Downloadable IOCs: 6

Tag: wordpress

Attack reports

The Rise of Online Casino Spam

Attackers Actively Exploiting Critical Vulnerability in Service Finder Bookings Plugin

Hidden WordPress Backdoors Creating Admin Accounts

Malicious JavaScript Injects Fullscreen Iframe On a WordPress Website

Efimer Trojan delivered via email and hacked WordPress websites

Active Exploitation of CVE-2025-5394 in Alone WordPress Theme

Stealthy PHP Malware Uses ZIP Archive to Redirect WordPress Visitors

Attackers Inject Code into WordPress Theme to Redirect Visitors

Deploying NetSupport RAT via WordPress & ClickFix

Fake Spam Plugin Uses Victim's Domain Name to Evade Detection

Analysis of a Malicious WordPress Plugin: The Covert Redirector

What is the Real Relationship between WordPress Hackers and Malicious Adtech?

Part 2: Compromised WordPress Pages and Malware Campaigns

Proton66: Compromised WordPress Pages and Malware Campaigns

Stripe API Skimming Campaign: Additional Victims & Insights

Fake Cloudflare Verification Results in LummaStealer Trojan Infections

Credit Card Skimmer and Backdoor on WordPress E-commerce Site

Cascading Redirects: Unmasking a Multi-Site JavaScript Malware Campaign

Fake WordPress Plugin Impacts SEO by Injecting Casino Spam

Stealthy Credit Card Skimmer Targets WordPress Checkout Pages via Database Injection

PHP Reinfector and Backdoor Malware Target WordPress Sites

AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services

2024 Credit Card Theft Season Arrives

DarkCracks, an advanced malicious payload & upgrade framework utilizing hacked GLPI and WordPress sites as intermediaries

Fake update puts visitors at risk

Supposed Grasshopper: operators impersonate Israeli government and private companies to deploy open-source malware

Active exploitation of stored XSS vulnerabilities in WordPress Plugins

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin