Researchers at Defiant, the company behind the Wordfence security plugin for WordPress websites, have come across a malvertising campaign that leverages recently disclosed plugin vulnerabilities to inject malicious code into websites.
The hackers have been using flaws in WordPress plugins such as “Coming Soon and Maintenance Mode,” “Yellow Pencil Visual CSS Style Editor” and “Blog Designer” to achieve their goals. Each of these plugins has thousands or tens of thousands of active installations.
According to Defiant, the attackers are exploiting these vulnerabilities to inject a small piece of JavaScript code into affected WordPress websites. The script is designed to fetch additional code from an external domain and execute that code when a user visits the compromised website.
Victims are first redirected to a domain that checks the type of device they are using and, based on that and other factors, redirects them to one of several types of malicious or scammy destinations, including tech support scams, shady pharma ads, and malicious Android APKs. In some cases, the exploit targets the user’s browser directly and attempts to convince them to click on various things.
The attackers have exploited stored cross-site scripting (XSS) vulnerabilities in Blog Designer and Coming Soon and Maintenance Mode, and an unauthenticated arbitrary options update weakness in the Yellow Pencil plugin.
The Yellow Pencil flaw was first exploited in April, just days after a researcher disclosed its details and published a proof-of-concept (PoC). This vulnerability can be highly useful for attackers as it allows them to create new admin users, enabling them to easily take control of a WordPress site.
“The majority of the XSS injection attempts tracked across this campaign were sent by IP addresses linked to popular hosting providers,” explained Defiant’s Mikey Veenstra. “With attacks sourced from IPs hosting several live websites, as well as our own evidence of infected sites associated with this campaign, it’s likely the threat actor is using infected sites to deliver XSS attacks by proxy.”
Defiant’s blog post contains indicators of compromise (IoC) that can be useful to defenders.
Related: Zero-Days in WordPress Plugin Actively Exploited
Related: Hackers Exploit Flaw in GDPR Compliance Plugin for WordPress
Related: Hackers Target WordPress Sites via WP Cost Estimation Plugin
Related: Former Employee Hacks Popular WordPress Plugin’s Website
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
Latest News
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
- Apple Denies Helping US Government Hack Russian iPhones
