Reverse-engineered code redirects visitors to dodgy corners of the internet
An investigation by analysts at Sucuri into malware found on WordPress installations revealed a much larger and ongoing campaign that last month, we're told, hijacked more than 6,600 websites. The team has seen a spike in complaints this month related to the intrusions, according to analyst Krasimir Konov.
Those included such files as ./wp-includes/js/jquery/jquery.min.js and ./wp-includes/js/jquery/jquery-mgrate.min.js. Essentially, miscreants are compromising websites, and then try to automatically inject their own malicious code into any .js files with jQuery in the filename.
To do this, the malicious injection creates a new script element on the page with a domain of legendarytable[.]com as the source. The code from that domain calls out to second external domain – local[.]drakefollow[.]com – which calls out to another one, setting up a series of domains the visitor is sent through until they're redirected to a site of one of many different domains.
- Time for people to patch backup plugin for WordPress
- Don't be a WordPress RCE-hole and patch up this XSS vuln, pronto
- Couldn't give a fsck about patching? Well, that's your WordPress website pwned, then
"At this point, it's a free for all," Konov wrote. "Domains at the end of the redirect chain may be used to load advertisements, phishing pages, malware, or even more redirects."
Before landing on the final destination page, some visitors are sent to a fake CAPTCHA page, which tries to trick them into subscribing to push notifications from the malicious site.
"If they click on the fake CAPTCHA, they'll be opted in to receive unwanted ads even when the site isn't open — and ads will look like they come from the operating system, not from a browser," he wrote.
"These sneaky push notification opt-in maneuvers also happen to be one of the most common ways attackers display 'tech support' scams, which inform users that their computer is infected or slow and they should call a toll-free number to fix the problem."
WordPress powers about 43 percent of the websites on the internet, according to W3Techs, but that reach also makes it a popular target for bad actors. About 90 percent of the requests they get for cleaning up a website were related to WordPress, with malicious redirects being the result of some of the most common malware infections, Sucuri said.
"As new vulnerabilities in WordPress plugins are discovered, we anticipate that they will be caught up in the massive ongoing redirect campaign sending unsuspecting victims to fraudulent websites and tech support scams," they wrote. ®