More Than 4,500 WordPress Websites Compromised And Redirected Users to Sketchy Ad Pages

More Than 4,500 WordPress Websites Compromised And Redirected Users to Sketchy Ad Pages

Over 4,500 WordPress websites have been infected as part of a large-scale campaign that has reportedly been ongoing since at least 2017. According to GoDaddy-owned Sucuri, which is intended to reroute users to undesired websites, a malicious domain called “track[.]violetlovelines[.]com” is hosting obfuscated JavaScript infections.

The data from reveals that the most recent operation is claimed to have been running since December 26, 2022. More than 3,600 sites were affected by an earlier wave observed in early December 2022, while more than 7,000 sites were affected by an attack wave observed in September 2022. The malicious code was added to the WordPress index.php file, and Sucuri disclosed that it had been deleted from more than 33,000 other files on the hijacked sites for the last 60 days.

“In recent months, this malware campaign has gradually switched from the notorious fake CAPTCHA push notification scam pages to black hat ‘ad networks’ that alternate between redirects to legitimate, sketchy, and purely malicious websites,” said Sucuri researcher Denis Sinegubko.

Therefore, a traffic direction system is used to start a redirect chain when unwary people visit one of the compromised WordPress sites, leading the victims to websites presenting dubious adverts for goods that ironically combat intrusive ads. Even more concerning, depending on the web browser being used, the website for one such ad blocker called Crystal Blocker is designed to display deceptive browser update alerts to deceive users into installing its extension.

Nearly 110,000 people use the browser extension across Google Chrome (60,000+), Microsoft Edge (40,000+), and Mozilla Firefox (8,635). While the extensions do offer ad-blocking capability, Sinegubko noted that there is no assurance that using them would be secure since they might have hidden features in either the current version or any upgrades that may come in the future.

Some of the redirections are even downright malicious, using the compromised websites as a conduit to start drive-by downloads. This also entails downloading Raccoon Stealer, a malware program that may steal private information, including passwords, cookies, autofill information from browsers, and cryptocurrency wallets, through the Discord CDN. The discoveries come at a time when threat actors create websites that mimic a range of genuine products to disseminate trojans and stealth programs through malicious advertisements in Google search results.

Since then, Google has acted to block one of the malicious sites employed in the redirect scheme, designating it as a dangerous website that places “unwanted or malicious software on visitors’ computers.” WordPress site owners are encouraged to update installed themes and plugins, delete those that are underused or abandoned by their authors, and change passwords to reduce the risk of such cyberattacks.

About the author

Yehudah Sunshine

Yehudah Sunshine

Bringing together his diverse professional cyber know-how, intellectual fascination with history and culture, and eclectic academic background focusing on diplomacy and the cultures of Central Asia, Yehudah Sunshine keenly blends his deep understanding of the global tech ecosystem with a nuanced worldview of the underlying socio-economic and political forces which drive policy and impact innovation in the cyber sectors. Yehudah's current work focuses on how to create and or opportunities enhance marketing strategies and elevate cyber driven thought leadership for cyfluencer (www.cyfluencer .com), the cybersecurity thought leadership platform. Sunshine has written and researched extensively within cybersecurity, the service sectors, international criminal accountability, Israel's economy, Israeli diplomatic inroads, Israeli innovation and technology, and Chinese economic policy.