Keylogger Campaign Returns

Keylogger campaign returns, infecting 2,000 WordPress sites

Over 2,000 WordPress sites are infected with a malicious script that can deliver both a keylogger and the in-browser cryptocurrency miner CoinHive. – Keylogger

Researchers at Sucuri who made the discovery said the recent campaign is tied to threat actors behind a December 2017 campaign that infected over 5,500 WordPress sites. Both incidents used a keylogger/cryptocurrency malware called Cloudflare solutions. The name is derived from the domain used to serve up the malicious scripts in the first campaign, Cloudflare solutions.

Cloudflare solutions – Keylogger Campaign

Cloudflare solutions are in no way related to network management and security firm Cloudflare.

“While these new attacks do not yet appear to be as massive as the original Cloudflare solutions, the reinfection rate shows that there are still many sites that have failed to properly protect themselves after the original infection,” wrote Denis Sinegubko, a senior malware researcher at Sucuri who authored research blog this week. Continue reading →