Over 15,000 WordPress Sites Compromised in Malicious SEO Campaign

A new malicious marketing campaign has compromised above 15,000 WordPress web-sites in an endeavor to redirect visitors to bogus Q&A portals.

“These destructive redirects surface to be created to improve the authority of the attacker’s web-sites for research engines,” Sucuri researcher Ben Martin mentioned in a report published last week, calling it a “intelligent black hat Web optimization trick.”

The lookup engine poisoning method is made to endorse a “handful of bogus very low excellent Q&A internet sites” that share identical internet site-setting up templates and are operated by the very same threat actor.

A notable part of the marketing campaign is the means of the hackers to modify in excess of 100 files on regular for each internet site, an tactic that contrasts substantially from other assaults of this form wherein only a confined selection of data files are tampered with to cut down footprint and escape detection.

Some of the most normally contaminated internet pages consist of secure-signup-hashsd883jd.htm, wp-cron.php, wp-inbound links-opml.php, wp-options.php, wp-comments-post.php, wp-mail.php, xmlrpc.php, wp-activate.php, wp-trackback.php, and wp-website-header.php.

This considerable compromise makes it possible for the malware to execute the redirects to web sites of the attacker’s choice. It truly is truly worth pointing out that the redirects don’t come about if the wordpress_logged_in cookie is existing or if the existing web site is wp-login.php (i.e., the login page) so as to steer clear of boosting suspicion.

The ultimate objective of the marketing campaign is to “travel much more targeted traffic to their bogus sites” and “increase the sites’ authority using fake search consequence clicks to make Google rank them better so that they get more serious organic and natural search targeted visitors.”

The injected code achieves this by initiating a redirect to a PNG picture hosted on a area named “ois[.]is” that, rather of loading an image, can take the web site visitor to a Google lookup outcome URL of a spam Q&A domain.

It is not immediately clear how the WordPress sites are breached, and Sucuri stated it did not discover any obvious plugin flaws getting exploited to carry out the marketing campaign.

That mentioned, it truly is suspected to be a scenario of brute-forcing the WordPress administrator accounts, generating it necessary that buyers allow two-variable authentication and ensure that all software is up-to-day.

Uncovered this report fascinating? Comply with THN on Facebook, Twitter  and LinkedIn to study a lot more unique content we write-up.

Some parts of this article are sourced from:
thehackernews.com