Categories: SecurityWorkspace

Hacker Group Looks To Gain Control Over Vulnerable WordPress Sites

An ongoing attack on WordPress plugins has been altered into a more dangerous form as hackers seek to gain more control over vulnerable websites, a researcher has warned.

The initial attack, which began in July, involved targeting vulnerable plugins to gain access to WordPress sites and install malicious code, said researcher Mikey Veenstra of Defiant.

The initial code displayed ads or redirected visitors to third-party websites, he said.

But beginning on 20 August the attackers modified the malicious code already planted on sites to make it try and create malicious administrator accounts, Veenstra said in an advisory.

Rogue accounts

When an administrator logs into an infected WordPress site, the malware attempts to use the user’s credentials to create a new admin account named wpservices.

The new account is under the attackers’ control and could be used to carry out further actions, Veenstra said.

“With this user (account)  in place, the attacker is free to install further backdoors or perform other malicious activity,” he wrote.

The shift is a sign that the attackers may be preparing to carry out further attacks via infected WordPress sites, Veenstra said.

Patches

The attacks are currently targeting the following list of WordPress plugins, according to Veenstra:

Bold Page Builder
Blog Designer
Live Chat with Facebook Messenger
Yuzo Related Posts
Visual CSS Style Editor
WP Live Chat Support
Form Lightbox
Hybrid Composer
All former NicDark plugins (nd-booking, nd-travel, nd-learning, et. al.)

He advised users to immediately update their plugins to the latest version to avoid exposing their sites to hacks.

Users should also remove any unauthorised accounts created by the malware and carry out scans to ensure the site is free from other backdoors, Veenstra said.

“As always, updating the plugins and themes on your WordPress site is an excellent layer of defense against campaigns like these,” he said.

“Check your site for needed updates frequently to ensure you’re receiving the latest patches as they’re released.”

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

Latvia Set To Release Covid-19 App Based On Tech Companies’ Framework

Latvia is aiming to be one of the first countries to release a Covid-19 contact-tracing…

1 day ago

SpaceX Prepares For First Manned Mission

SpaceX Crew Dragon set to deliver two NASA astronauts to International Space Station this week,…

1 day ago

Arsonists Attack 5G Mast In Derbyshire

5G mobile phone mast set on fire only days after it was erected, as experts…

1 day ago

UK Looks To Scale Back Huawei Deal In Wake Of Pandemic

Prime minister Boris Johnson has reportedly ordered plans drawn up that would see Huawei's involvement…

2 days ago

Uber Passenger Says Price-Fixing Arbitrator Acted Out Of ‘Fear’

Uber passenger asks court to reopen price-fixing lawsuit against the company, saying arbitrator who ruled…

2 days ago

GitLab Hacks Own Remote-Working Staff In Phishing Test

Company finds 20 percent of its all-remote staff responds to phishing message by exposing user…

2 days ago