Researchers at Defiant, the company behind the Wordfence security plugin for WordPress websites, have come across a malvertising campaign that leverages recently disclosed plugin vulnerabilities to inject malicious code into websites.
The hackers have been using flaws in WordPress plugins such as “Coming Soon and Maintenance Mode,” “Yellow Pencil Visual CSS Style Editor” and “Blog Designer” to achieve their goals. Each of these plugins has thousands or tens of thousands of active installations.
According to Defiant, the attackers are exploiting these vulnerabilities to inject a small piece of JavaScript code into affected WordPress websites. The script is designed to fetch additional code from an external domain and execute that code when a user visits the compromised website.
Victims are first redirected to a domain that checks the type of device they are using and, based on that and other factors, redirects them to one of several types of malicious or scammy destinations, including tech support scams, shady pharma ads, and malicious Android APKs. In some cases, the exploit targets the user’s browser directly and attempts to convince them to click on various things.
The attackers have exploited stored cross-site scripting (XSS) vulnerabilities in Blog Designer and Coming Soon and Maintenance Mode, and an unauthenticated arbitrary options update weakness in the Yellow Pencil plugin.
The Yellow Pencil flaw was first exploited in April, just days after a researcher disclosed its details and published a proof-of-concept (PoC). This vulnerability can be highly useful for attackers as it allows them to create new admin users, enabling them to easily take control of a WordPress site.
“The majority of the XSS injection attempts tracked across this campaign were sent by IP addresses linked to popular hosting providers,” explained Defiant’s Mikey Veenstra. “With attacks sourced from IPs hosting several live websites, as well as our own evidence of infected sites associated with this campaign, it’s likely the threat actor is using infected sites to deliver XSS attacks by proxy.”
Defiant’s blog post contains indicators of compromise (IoC) that can be useful to defenders.
Related: Zero-Days in WordPress Plugin Actively Exploited
Related: Hackers Exploit Flaw in GDPR Compliance Plugin for WordPress
Related: Hackers Target WordPress Sites via WP Cost Estimation Plugin
Related: Former Employee Hacks Popular WordPress Plugin’s Website
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
