back-2 (2)

WP3.XYZ malware attacks add rogue admins to 5,000+ WordPress sites

Teilen:

A new malware campaign has compromised more than 5,000 WordPress sites to create admin accounts, install a malicious plugin, and steal data.

Researchers at webscript security company c/side discovered during an incident response engagement for one of their clients that the malicious activity uses the wp3[.]xyz domain to exfiltrate data but have yet to determine the initial infection vector.

After compromising a target, a malicious script loaded from the wp3[.]xyz domain creates the rogue admin account wpx_admin with credentials available in the code.

Creating a rogue admin account
Creating a rogue admin account
Source: c/side

The script then proceeds to install a malicious plugin (plugin.php) downloaded from the same domain, and activates it on the compromised website.

According to c/cide, the purpose of the plugin is to collect sensitive data, like administrator credentials and logs, and send it to the attacker’s server in an obfuscated way that makes it appear as an image request.

The attack also involves several verification steps, such as logging the status of the operation after the creation of the rogue admin account and verifying the installation of the malicious plugin.

Blocking the attacks

c/side recommends that website owners block the ‘wp3[.]xyz’ domain using firewalls and security tools.

Moreover, admins should review other privileged accounts and the list of installed plugins, to identify unauthorized activity, and remove them as soon as possible.

Finally, it is recommended that CSRF protections on WordPress sites be strengthened via unique token generation, server-side validation, and periodic regeneration. Tokens should have a short expiration time to limit their validity period.

Implementing multi-factor authentication also adds protection to accounts with credentials that have already been compromised.

Quelle

Kommentar verfassen

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

lade-bild
London, GB
1:53 pm, Apr. 19, 2025
Wetter-Symbol 16°C
L: 15° | H: 17°
overcast clouds
Luftfeuchtigkeit: 51 %
Druck: 1008 mb
Wind: 9 mph SE
Windböe: 21 mph
UV-Index: 0
Niederschlag: 0 mm
Wolken: 100%
Regen Chance: 0%
Sichtbarkeit: 10 km
Sonnenaufgang: 5:55 am
Sonnenuntergang: 8:02 pm
TäglichStündlich
Tägliche VorhersageStündliche Vorhersage
Today 10:00 pm
Wetter-Symbol
15° | 17°°C 0 mm 0% 14 mph 63 % 1008 mb 0 mm/h
Tomorrow 10:00 pm
Wetter-Symbol
6° | 13°°C 0 mm 0% 10 mph 83 % 1008 mb 0 mm/h
Mo. Apr. 21 10:00 pm
Wetter-Symbol
9° | 13°°C 0.52 mm 52% 6 mph 92 % 1014 mb 0 mm/h
Di. Apr. 22 10:00 pm
Wetter-Symbol
8° | 16°°C 0 mm 0% 7 mph 92 % 1020 mb 0 mm/h
Mi. Apr. 23 10:00 pm
Wetter-Symbol
8° | 13°°C 1 mm 100% 12 mph 95 % 1019 mb 0 mm/h
Today 4:00 pm
Wetter-Symbol
14° | 15°°C 0 mm 0% 14 mph 50 % 1008 mb 0 mm/h
Today 7:00 pm
Wetter-Symbol
13° | 14°°C 0 mm 0% 12 mph 55 % 1008 mb 0 mm/h
Today 10:00 pm
Wetter-Symbol
8° | 8°°C 0 mm 0% 10 mph 63 % 1008 mb 0 mm/h
Tomorrow 1:00 am
Wetter-Symbol
8° | 8°°C 0 mm 0% 9 mph 73 % 1008 mb 0 mm/h
Tomorrow 4:00 am
Wetter-Symbol
6° | 6°°C 0 mm 0% 8 mph 79 % 1008 mb 0 mm/h
Tomorrow 7:00 am
Wetter-Symbol
6° | 6°°C 0 mm 0% 8 mph 79 % 1008 mb 0 mm/h
Tomorrow 10:00 am
Wetter-Symbol
12° | 12°°C 0 mm 0% 10 mph 62 % 1007 mb 0 mm/h
Tomorrow 1:00 pm
Wetter-Symbol
13° | 13°°C 0 mm 0% 9 mph 66 % 1007 mb 0 mm/h
Name Preis24H (%)
Bitcoin(BTC)
€74,983.22
0.70%
Ethereum(ETH)
€1,404.10
0.16%
Fesseln(USDT)
€0.88
0.01%
XRP(XRP)
€1.83
-0.10%
Solana(SOL)
€121.95
2.76%
USDC(USDC)
€0.88
0.00%
Dogecoin(DOGE)
€0.138771
1.01%
Shiba Inu(SHIB)
€0.000011
1.00%
Pepe(PEPE)
€0.000006
0.15%
Nach oben scrollen