Hackers Backdoor Sites by Hiding Fake WordPress Plugins

guest · Oct 20, 2019

Hackers Backdoor Sites by Hiding Fake WordPress Plugins
October 18, 2019
https://www.bleepingcomputer.com/ne...kdoor-sites-by-hiding-fake-wordpress-plugins/

Malicious plugins that hide in plain sight and act as backdoors are used by attackers to gain and maintain a foothold on WordPress websites, and to upload web shells and scripts for brute-forcing other sites.

For instance, some of these fake plugins with backdoor functionality — named initiatorseo or updrat123 by their creators — were seen cloning the functionality of the highly popular backup/restore WordPress plugin UpdraftPlus, with a current active number of over two million installations.

"The metadata comments within these fake plugins include copies from version 1.16.16 of UpdraftPlus, which was released on July 23rd, 2019," found researchers at web security and protection company Sucuri.
These fake plugins' main purpose is to act as backdoors on the compromised WordPress websites and to provide the attackers with access to the servers even after the original infection vector was removed.
Click to expand...

Sucuri: Fake UpdraftPlus Plugins

Log in or Sign up

Hackers Backdoor Sites by Hiding Fake WordPress Plugins

guest Guest

Log in or Sign up

Hackers Backdoor Sites by Hiding Fake WordPress Plugins

guest Guest

Useful Searches