Thousands of WordPress websites hacked via plugin looking to steal user data

1 month ago

Representational image depecting cybersecurity protection

(Image credit: Shutterstock)

A caller version of nan infamous ClearFake (AKA ClickFix) malware has been detected successful nan wild, and has already managed to discuss thousands of WordPress websites.

Researchers from GoDaddy declare to person spotted a version of this campaign, which installs malicious plugins to sites connected nan website builder. The threat actors would usage nan credentials stolen elsewhere (or bought connected nan achromatic market) to log into nan website’s WordPress admin account, and instal a seemingly benign plugin.

The victims are past enticed to download an update, which is conscionable a portion of malware that steals delicate data, aliases does thing other but arsenic sinister.

Thousands of compromised websites

In turn, nan plugin displays nan various popups, requesting nan victims do different actions (all of which lead to nan installation of infostealers).

The full process is automated, GoDaddy is saying, and truthful acold much than 6,000 WordPress websites person fallen prey.

"These seemingly morganatic plugins are designed to look harmless to website administrators but incorporate embedded malicious scripts that present clone browser update prompts to end-users,” nan researchers are saying. The plugins are “seemingly legitimate” arsenic they transportation family names successful nan WordPress world, specified arsenic Wordfense Security, aliases LiteSpeed Cache.

Here is nan afloat database of nan plugins spotted truthful far:

Sign up to nan TechRadar Pro newsletter to get each nan apical news, opinion, features and guidance your business needs to succeed!

LiteSpeed Cache Classic
MonsterInsights Classic
Wordfence Security Classic
Search Rank Enhancer
SEO Booster Pro
Google SEO Enhancer
Rank Booster Pro
Admin Bar Customizer
Advanced User Manager
Advanced Widget Manage
Content Blocker
Universal Popup Plugin

ClearFake is simply a type of malware onslaught we’ve each seen successful nan past - a website is compromised and utilized to show a clone popup notification. This notification usually mimics an antivirus warning, aliases a browser notification, and informs nan personification that their machine is either infected pinch a virus, aliases outdated and truthful incapable to show nan desired website.

Via BleepingComputer

More from TechRadar Pro

Thousands of Zimbra servers attacked pursuing email relationship compromise
Here's a database of nan best firewalls today
These are nan best endpoint protection tools correct now

Sead is simply a seasoned freelance journalist based successful Sarajevo, Bosnia and Herzegovina. He writes astir IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, information breaches, laws and regulations). In his career, spanning much than a decade, he’s written for galore media outlets, including Al Jazeera Balkans. He’s besides held respective modules connected contented penning for Represent Communications.

Source Technology