- Researchers discover 10,000 compromised WordPress -web
- The sites were embedded with malicious javascript code
- The goal was to provide infoTeals to the victims
Ten thousand WordPress places were used to deliver infostealing malware to victims running both Windows and MacOS devices, experts have warned.
A report from cybersecurity scientists on C/Side claims that a threat actor is likely to compromise different WordPress websites using an older version of the platform (6.7.1) and with it -an older, outdated plugin. Once the websites are violated, the attackers would insert malicious JavaScript code that would generate a fake page in an iFrame, to the visitors.
When a victim visits one of these sites, they would see a deliberate page that they have to update their browser if they want to see the content of the page. Instead of downloading a patch, however, the victims would get either atomic (alias Amos, a popular infoTeal for macOS) or Socgholish (basically the same thing, just for Windows).
Stealing sensitive files
These infostealers would grab all kinds of sensitive information from the target endpoint -from passwords stored in the browser, to session cookies, cryptocurrency -design book information and other potentially sensitive files.
Defending against these attacks requires web administrators to keep their sites up to date.
The WordPress Website Builder platform will start with upgrades to version 6.7, released in mid-November 2024. The administrators must then review all the themes and plugins they have installed and remove all those they do not use. The remaining must also be updated.
Finally, administrators should look for malicious manuscripts and erase them. C/Side claims that attackers leave a back door most of the time to be able to easily return if needed. If they find traces of compromise, they should also review logs from the last 90 days to identify what kind of malicious activity was performed.
