CUIDADO com o plugin WordPress do Coronavírus que infecta sites com malware WP-VCD

Just when you thought hackers could not get any lower, they go past the bottom. Hackers have found a way to exploit legitimate WordPress plugins and themes by injecting itself in plugins which show stats for Coronavirus also known as the COVID-19 virus.

Esses exploits estão sendo usados em vários tipos de ataques, incluindo ransomware, malware e domínios maliciosos.

Tenha muito cuidado com qualquer plug-in do Coronavirus WordPress e não baixe de sites que não sejamWordPress.org

NÃO BAIXE NENHUM SOFTWARE DE

www[dot]downloadfreethemes[dot]co
themesubmit[dot]com
www[dot]downloadfreethemes[dot]space, freesoft[dot]royalbeats[dot]in
freedownloadthemes[dot]co
raybans[dot]com[dot]co
coursefree[dot]co


For full details Analysis on the Injection points, files, and how the hackers are breaking into sites. Consulte os detalhes no site do WebARX.

Análise

Ponto de injeção

During the analysis of multiple samples, we noticed that all themes contained a file called class.theme-modules.php and all plugins contained a file called class.plugin-modules.php. Both files contained the exact same code.

In plugins, the hackers used the class.plugin-modules.php file which would be loaded in the main file of the plugin on the first line by injecting the following (reformatted):

See more here: https://www.webarxsecurity.com/wp-vcd-malware-analysis/