{"id":8533,"date":"2025-03-06T11:06:52","date_gmt":"2025-03-06T11:06:52","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/1000-wordpress-sites-infected-with-backdoors\/"},"modified":"2025-03-06T11:06:54","modified_gmt":"2025-03-06T11:06:54","slug":"1000-wordpress-sites-infected-with-backdoors","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/1000-wordpress-sites-infected-with-backdoors\/","title":{"rendered":"1,000+ WordPress Sites Infected with Backdoors"},"content":{"rendered":"\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Mar 06, 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Data Breach \/ Website Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\">\n<a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhHX-B4i_w9DL-IFy27W9xmdKPQo98Q-e5hHgnWLC5Tly1hCCQ1_z1JsMr0Dg73C9TnpxhYv9FYKl1idTGEA6TDTw-hC2mb0fg9WDFV38kPLXYI53k4vkGvdrQ_KNlCH054dHy-CEcSEQgHtbFWNuIM3q3r4uDE3VvVO0P9DjCdpsU9FZOgSOw6f6caLpIF\/s728-rw-e365\/js-malware-code.png\" style=\"display: block;  text-align: center; clear: left; float: left;\" rel=\"nofollow noopener\" target=\"_blank\"><\/p>\n<p><\/a>\n<\/div>\n<p>More than 1,000 websites that utilize the WordPress platform have been compromised by a malicious third-party JavaScript code, resulting in the injection of four separate backdoors.<\/p>\n<p>According to c\/side researcher Himanshu Anand, &#8220;The presence of four backdoors allows attackers to maintain multiple points of re-entry, making it more challenging to completely remove their access, even if one backdoor is detected and eliminated,&#8221; as stated in a <a href=\"https:\/\/cside.dev\/blog\/thousands-of-websites-hit-by-four-backdoors-in-3rd-party-javascript-attack\" rel=\"noopener nofollow\" target=\"_blank\">recent analysis<\/a>.<\/p>\n<p>The malicious JavaScript code is being served from the domain cdn.csyndication[.]com. Currently, <a href=\"https:\/\/publicwww.com\/websites\/csyndication.com\/\" rel=\"noopener nofollow\" target=\"_blank\">908 websites<\/a> have been found to contain references to this domain.<\/p>\n<div class=\"dog_two clear\">\n<center class=\"cf\"><br \/>\n<a href=\"https:\/\/thehackernews.uk\/cis-securesuite\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><br \/>\n<img fetchpriority=\"high\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhsFQaSLfkFdKcodtNnSya8V2yj1C_ZVcqQImhnHDikdLhrgZ4hoAIdzNPEjMn6tIl2dSBa9PZVJm5Q6CW4Iprd32O0xaNt3UTVX1U9kEK629GDLqpr7Dd6lynygeNXdkuKNi_TlVZ1vRZI_fXFdvFwBm25WNf4tQHZfgpXHiaw1nnd6E5jLX8vrn4fB3mN\/s728-e100\/cis-d.png\" width=\"727\" height=\"90\"\/><br \/>\n<\/a><br \/>\n<\/center>\n<\/div>\n<p>The following is an explanation of the functions of the four backdoors:<\/p>\n<ul>\n<li>Backdoor 1: Uploads and installs a fake plugin named &#8220;Ultra SEO Processor&#8221; to execute attacker-issued commands.<\/li>\n<li>Backdoor 2: Injects malicious JavaScript into the wp-config.php file.<\/li>\n<li>Backdoor 3: Adds an attacker-controlled SSH key to the ~\/.ssh\/authorized_keys file to enable persistent remote access to the machine.<\/li>\n<li>Backdoor 4: Executes remote commands and fetches another payload from <a href=\"https:\/\/thehackernews.com\/2025\/01\/python-based-bots-exploiting-php.html\" rel=\"noopener nofollow\" target=\"_blank\">gsocket[.]io<\/a> to likely establish a reverse shell.<\/li>\n<\/ul>\n<p>To minimize the risk posed by these attacks, users are advised to delete unauthorized SSH keys, rotate WordPress admin credentials, and monitor system logs for suspicious activity.<\/p>\n<p>This development comes as a cybersecurity company <a href=\"https:\/\/cside.dev\/blog\/over-35-000-websites-targeted-in-full-page-hijack-linking-to-a-chinese-language-gambling-scam\" rel=\"noopener nofollow\" target=\"_blank\">reported<\/a> another malware campaign compromising over 35,000 websites with malicious JavaScript that &#8220;fully hijacks the user&#8217;s browser window&#8221; to redirect visitors to Chinese-language gambling platforms.<\/p>\n<p>The attack appears to be targeting regions where Mandarin is commonly spoken, and the final landing pages display gambling content under the &#8216;Kaiyun&#8217; brand.<\/p>\n<p>The redirections occur through JavaScript hosted on five different domains, serving as a loader for the main payload responsible for the redirects:<\/p>\n<ul>\n<li>mlbetjs[.]com<\/li>\n<li>ptfafajs[.]com<\/li>\n<li>zuizhongjs[.]com<\/li>\n<li>jbwzzzjs[.]com<\/li>\n<li>jpbkte[.]com<\/li>\n<\/ul>\n<div class=\"dog_two clear\">\n<center class=\"cf\"><br \/>\n<a href=\"https:\/\/thehackernews.uk\/cloud-secure-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\" title=\"Cybersecurity\"><br \/>\n<img decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhPWsOsc5-XgG7OgLaedicSgtFyWz34mXvDdyCyBN0HSv2LVBMQPs-Ma8uaYGqN19Mvm7puED6vlOFihpguPFfq-e_PQ6pfqHPeMKSX6luNSqXs_m3IHmaA6waPe8qHtxB35qw_CdmXzEDQ30crRU_-UvN9w8cSL1W51CocP1fJXyJIrdUcBNvSaMyhb_cV\/s728-e100\/cloud-secure-d.jpg\" width=\"727\" height=\"90\"\/><br \/>\n<\/a><br \/>\n<\/center>\n<\/div>\n<p>A recent report from Group-IB also revealed a threat actor known as <b>ScreamedJungle<\/b> that injects a JavaScript code named Bablosoft JS into compromised Magento websites to collect fingerprints of visiting users, impacting over 115 e-commerce sites to date.<\/p>\n<p>The injected script is part of the <a href=\"https:\/\/thehackernews.com\/2022\/05\/hackers-increasingly-using-browser.html\" rel=\"noopener nofollow\" target=\"_blank\">Bablosoft BrowserAutomationStudio<\/a> (BAS) suite, which contains several functions to collect information about the system and browser of users visiting the compromised website, according to the Singaporean company, which <a href=\"https:\/\/www.group-ib.com\/blog\/fingerprint-heists\/\" rel=\"noopener nofollow\" target=\"_blank\">reported<\/a> that the attackers are exploiting known vulnerabilities affecting vulnerable Magento versions (e.g., <a href=\"https:\/\/thehackernews.com\/2024\/10\/alert-adobe-commerce-and-magento-stores.html\" rel=\"noopener nofollow\" target=\"_blank\">CVE-2024-34102<\/a> aka CosmicSting and CVE-2024-20720) to breach the websites.<\/p>\n<p>The financially motivated threat actor was first discovered in the wild in late May 2024 and has been using browser fingerprinting, a technique commonly used by websites to track user activities and tailor marketing strategies, but also exploited by cybercriminals to mimic legitimate user behavior, evade security measures, and conduct fraudulent activities.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Found this article interesting?  Follow us on <a href=\"https:\/\/twitter.com\/thehackersnews\" rel=\"noopener nofollow\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" rel=\"noopener nofollow\" target=\"_blank\">LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/03\/over-1000-wordpress-sites-infected-with.html\" rel=\"nofollow noopener\" target=\"_blank\">Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue802Mar 06, 2025\ue804Ravie LakshmananData Breach \/ Website Security More than 1,000 websites that utilize the WordPress platform have been compromised by a malicious third-party JavaScript code, resulting in the injection&#8230;<\/p>\n","protected":false},"author":19,"featured_media":8534,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-8533","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/js-malware-code.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/8533","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=8533"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/8533\/revisions"}],"predecessor-version":[{"id":8535,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/8533\/revisions\/8535"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/8534"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=8533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=8533"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=8533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}