WordPress Keylogger infection

Posted on Posted in WordPress

More than 2,000 websites running the open source WordPress content management system are infected with malware, researchers warned late last week. The malware in question logs passwords and just about anything else an administrator or visitor types.

The keylogger is part of a malicious package that also installs an in-browser cryptocurrency miner that's surreptitiously run on the computers of people visiting the infected sites. Data provided here, here, and here by website search service PublicWWW showed that, as of Monday afternoon, the package was running on 2,092 sites.

  • hxxps://cdjs[.]online/lib.js
  • hxxps://cdjs[.]online/lib.js?ver=…
  • hxxps://cdns[.]ws/lib/googleanalytics.js?ver=…
  • hxxps://msdns[.]online/lib/mnngldr.js?ver=…
  • hxxps://msdns[.]online/lib/klldr.js

Affected versions:

Recommended action: follow these steps. It is critical that site operators change all site passwords since the scripts give attackers access to all the old ones.

Origin URLs:

Leave a Reply

Your email address will not be published. Required fields are marked *