Thousands of WordPress sites have been infected by a mystery malware

Magnifying glass enlarging the word 'malware' in computer machine code
(Image credit: Shutterstock)

Thousands of WordPress websites were infected with an unknown malware variant, cybersecurity researchers from Sucuri have found. 

The malware would redirect the visitors to a different website, where ads hosted on the Google Ads platform would load, bringing in profits for the website’s owners.

The Sucuri team found an unknown threat actor managed to compromise almost 11,000 WordPress-powered websites. 


Protecting your business from the biggest threats online

Protecting your business from the biggest threats online
Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Preferred partner (What does this mean?) 

Redirected

WordPress is the world’s most popular web hosting platform, and is generally perceived as secure. However, it also offers countless WordPress plugins, some of which carry high-severity vulnerabilities. 

While the researchers could not pinpoint the exact vulnerability used to deliver this malware, they’re speculating that the threat actors automated the process and probably leveraged whatever known, unpatched flaws they could find. 

The malware’s modus operandi is simple - when people visit the infected websites, they would get redirected to a different Q&A website which loaded ads located on Google Ads. That way, Google would essentially get tricked into paying the ad campaign owners for the views, unaware that the views are actually fraudulent.

Sucuri has been tracking similar campaigns for months now. In late November last year, the researchers spotted a similar campaign that infected roughly 15,000 WordPress sites. The difference between these two campaigns is that in last year’s one - the attackers didn’t bother hiding the malware. In fact, they did the exact opposite, installing more than 100 malicious files per website,

In the new campaign, however, the attackers went to great lengths to try and hide the existence of the malware, the researchers said. They also made the malware somewhat more resilient to counter-measures, remaining persistent on the sites for longer periods of time.

To protect against such attacks, the researchers said, it’s best to keep the website and all of the plugins up to date, and keep the wp-admin panel secure with a strong password and multi-factor authentication. Those that have already been infected can follow Sucuri’s how-to guide, should change all access point passwords, and place the website behind a firewall.

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Thousands of WordPress websites hit in new malware attack, here's what we know
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
Over 10,000 WordPress sites found showing fake Google browser update pages to spread malware
WordPress on a laptop
Over 20,000 WordPress sites hit by damaging malware campaign
A close-up of an interent search bar with 'http://ww' visible
Major website hijacking scam sees over 35,000 sites attacked, redirected to gambling sites, so be on your guard
Wordpress brand logo on computer screen. Man typing on the keyboard.
Thousands of WordPress sites targeted with malicious plugin backdoor attacks
A person holding a credit card in one hand while typing on a laptop keyboard with the other.
WordPress users targeted by devious new credit card skimmer malware
Latest in Security
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
An image of network security icons for a network encircling a digital blue earth.
US government warns agencies to make sure their backups are safe from NAKIVO security issue
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
This top WordPress plugin could be hiding a worrying security flaw, so be on your guard
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Veeam urges users to patch security issues which could allow backup hacks
UK Prime Minister Sir Kier Starmer
The UK releases timeline for migration to post-quantum cryptography
Representational image depecting cybersecurity protection
Cisco smart licensing system sees critical security flaws exploited
Latest in News
Quordle on a smartphone held in a hand
Quordle hints and answers for Sunday, March 23 (game #1154)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Sunday, March 23 (game #385)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Sunday, March 23 (game #651)
Google Pixel 9 Pro Fold main display opened
Apple is rumored to be prioritizing battery life on the foldable iPhone – which could also feature a liquid metal hinge for added durability
Google Pixel 9
The Google Pixel 10 just showed up in Android code – and may come with a useful speed boost
L-mount alliance
Sirui joins L-Mount Alliance to deliver its superb budget lenses for Leica, DJI, Sigma and Panasonic cameras