Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Hackers Compromise Hundreds of WordPress Pages

Researchers at M86 Security say hackers have compromised hundreds of Web sites that use Wordpress as part of an attack campaign using the Phoenix exploit kit.

“A few days ago, hundreds of websites, based on WordPress 3.2.1, were compromised,” blogged Daniel Chechik, security researcher at M86 Security. “The attacker uploaded an HTML page to the standard Uploads folder and that page redirects the user to the Phoenix Exploit Kit. Its logs show that users from at least four hundred compromised sites were redirected to Phoenix exploit pages.”

Researchers at M86 Security say hackers have compromised hundreds of Web sites that use WordPress as part of an attack campaign using the Phoenix exploit kit.

“A few days ago, hundreds of websites, based on WordPress 3.2.1, were compromised,” blogged Daniel Chechik, security researcher at M86 Security. “The attacker uploaded an HTML page to the standard Uploads folder and that page redirects the user to the Phoenix Exploit Kit. Its logs show that users from at least four hundred compromised sites were redirected to Phoenix exploit pages.”

According to M86, the content uploaded by the attacker is not part of the homepage and will not show up when users browse these sites. In fact, accessing any page on the compromised WordPress sites other than the uploaded page will not infect the user, the company said.

“The general motivation of attackers to compromise websites is mainly to bypass URL reputation mechanisms, spam filters and certain security policies,” Chechik explained. “In order to lure users to these pages, the attacker sent thousands of malicious emails querying an unfamiliar bill and asking recipients to click on a link as described by Websense blog. The link points to the aforementioned uploaded page.”

“The exploit page is hosted in a Russian domain called horoshovsebudet which roughly translates as “Everything will be fine”, showing a certain sense of humor by these attackers,” he added. “The Phoenix Exploit Kit identifies the User Agent of the client machine and delivers a customized exploit Web page…(that) generates code which attempts exploiting multiple vulnerabilities in Microsoft Internet Explorer, Adobe PDF, Flash and Oracle Java as described in the Phoenix Exploit Kit blog. Among those exploits is the latest Java Rhino vulnerability as shown in the following screenshot and taken from the original malicious server.”

The Phoenix exploit kit has a long history on the cyber-underground. First spotted in 2007, the source code for version 2.5 was first reported leaked last April, forcing the author to update the tool shortly thereafter.

More information on the exploit kit can be found here.

Written By

Marketing professional with a background in journalism and a focus on IT security.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how the LOtL threat landscape has evolved, why traditional endpoint hardening methods fall short, and how adaptive, user-aware approaches can reduce risk.

Watch Now

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

People on the Move

Jessica Newman has joined Sophos as General Manager of Global Cyber Insurance.

Breach and attack simulation solutions provider AttackIQ has appointed Pete Luban as Field Chief Information Security Officer.

Matthew Cowell has assumed the role of VP of Strategic Alliances at Nozomi Networks. He previously served in the same role at Dragos.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.