Hacker Group Looks To Gain Control Over Vulnerable WordPress Sites

An ongoing attack on WordPress plugins has been altered into a more dangerous form as hackers seek to gain more control over vulnerable websites, a researcher has warned.

The initial attack, which began in July, involved targeting vulnerable plugins to gain access to WordPress sites and install malicious code, said researcher Mikey Veenstra of Defiant.

The initial code displayed ads or redirected visitors to third-party websites, he said.

But beginning on 20 August the attackers modified the malicious code already planted on sites to make it try and create malicious administrator accounts, Veenstra said in an advisory.

Rogue accounts

When an administrator logs into an infected WordPress site, the malware attempts to use the user’s credentials to create a new admin account named wpservices.

The new account is under the attackers’ control and could be used to carry out further actions, Veenstra said.

“With this user (account)  in place, the attacker is free to install further backdoors or perform other malicious activity,” he wrote.

The shift is a sign that the attackers may be preparing to carry out further attacks via infected WordPress sites, Veenstra said.

Patches

The attacks are currently targeting the following list of WordPress plugins, according to Veenstra:

Bold Page Builder
Blog Designer
Live Chat with Facebook Messenger
Yuzo Related Posts
Visual CSS Style Editor
WP Live Chat Support
Form Lightbox
Hybrid Composer
All former NicDark plugins (nd-booking, nd-travel, nd-learning, et. al.)

He advised users to immediately update their plugins to the latest version to avoid exposing their sites to hacks.

Users should also remove any unauthorised accounts created by the malware and carry out scans to ensure the site is free from other backdoors, Veenstra said.

“As always, updating the plugins and themes on your WordPress site is an excellent layer of defense against campaigns like these,” he said.

“Check your site for needed updates frequently to ensure you’re receiving the latest patches as they’re released.”