Skip to main content

Display Widgets Plug-In Conducted Malware Attack Across 200,000 WordPress Sites

Approximately 200,000 websites running WordPress have been affected by a malware attack from a plug-in that installed a backdoor, allowing a malicious actor to publish spam, collect IP addresses and more.
Wordfence, a security firm that focuses on the popular content management system, said in a blog post that the malware attack has been traced to a plug-in called Display Widgets, which was purportedly designed to manage the way other plug-ins are displayed on WordPress sites. Though it has recently been removed, the threat actor behind the malicious activity did not give up easily.
According to SecurityWeek, the original creator of Display Widgets sold it in late June, after which it was almost immediately updated with a backdoor. David Law, a freelance SEO consultant, noticed the initial malware attack and informed Wordfence, which removed it from the WordPress plug-in repository.
Just a few days later, however, Display Widgets emerged again, this time with an additional file called geolocation.php that could perform the same kind of malware attack, Bleeping Computer reported. When site owners looked at their WordPress admin panels, though, the malicious content was invisible; again, Law detected the malicious activity by tracking visits to an external server by the plug-in.
History then seemed to repeat itself in July and even earlier this month, an article on SC Magazine said, with the Display Widgets owner even making it obvious that the plug-in was being refined to continue launching the same kind of malware attack. In total, the plug-in was made available at least four times before it was pulled for good.
Law has since published his own account of the Display Widgets story. In the post, he provided an overview of the various versions involved and suggested deleting the plug-in. WordPress, meanwhile, banned the developer from its platform following the malware attack and issued critical alerts each time Display Widgets was removed.
Though the extent of the damage may have been limited to spamming various websites, the story illustrates how persistent cybercriminals can be, even in the face of repeated retaliatory action by companies the size of WordPress. It’s also a cautionary tale about the relative ease with which plug-ins can be bought, sold and repurposed for uses the original creators probably never would have imagined.

Comments

Popular posts from this blog

sxhkd volume andbrightness config for dwm on void

xbps-install  sxhkd ------------ mkdir .config/sxhkd cd .config/sxhkd nano/vim sxhkdrc -------------------------------- XF86AudioRaiseVolume         amixer -c 1 -- sset Master 2db+ XF86AudioLowerVolume         amixer -c 1 -- sset Master 2db- XF86AudioMute         amixer -c 1 -- sset Master toggle alt + shift + Escape         pkill -USR1 -x sxhkd XF86MonBrightnessUp          xbacklight -inc 20 XF86MonBrightnessDown          xbacklight -dec 20 ------------------------------------------------------------- amixer -c card_no -- sset Interface volume run alsamixer to find card no and interface names xbps-install -S git git clone https://git.suckless.org/dwm xbps-install -S base-devel libX11-devel libXft-devel libXinerama-devel  vim config.mk # FREETYPEINC = ${X11INC}/freetype2 #comment for non-bsd make clean install   cp config.def.h config.h vim config.h xbps-install -S font-symbola #for emoji on statusbar support     void audio config xbps-i

Hidden Wiki

Welcome to The Hidden Wiki New hidden wiki url 2015 http://zqktlwi4fecvo6ri.onion Add it to bookmarks and spread it!!! Editor's picks Bored? Pick a random page from the article index and replace one of these slots with it. The Matrix - Very nice to read. How to Exit the Matrix - Learn how to Protect yourself and your rights, online and off. Verifying PGP signatures - A short and simple how-to guide. In Praise Of Hawala - Anonymous informal value transfer system. Volunteer Here are five different things that you can help us out with. Plunder other hidden service lists for links and place them here! File the SnapBBSIndex links wherever they go. Set external links to HTTPS where available, good certificate, and same content. Care to start recording onionland's history? Check out Onionland's Museum Perform Dead Services Duties. Introduction Points Ahmia.fi - Clearnet search engine for Tor Hidden Services (allows you

download office 2021 and activate

get office from here  https://tb.rg-adguard.net/public.php open powershell as admin (win+x and a ) type cmd  goto insall dir 1.         cd /d %ProgramFiles(x86)%\Microsoft Office\Office16 2.           cd /d %ProgramFiles%\Microsoft Office\Office16 try 1 or 2 depending on installation  install volume license  for /f %x in ('dir /b ..\root\Licenses16\ProPlus2021VL_KMS*.xrm-ms') do cscript ospp.vbs /inslic:"..\root\Licenses16\%x" activate using kms cscript ospp.vbs /setprt:1688 cscript ospp.vbs /unpkey:6F7TH >nul cscript ospp.vbs /inpkey:FXYTK-NJJ8C-GB6DW-3DYQT-6F7TH cscript ospp.vbs /sethst:s8.uk.to cscript ospp.vbs /act Automatic script (windefender may block it) ------------------------------------------------------------------------------------------------------------------- @echo off title Activate Microsoft Office 2021 (ALL versions) for FREE - MSGuides.com&cls&echo =====================================================================================&