Whilst the world is shutting down because of COVID-19. I bring you three examples of recent WordPress Infections and ways to repair these infections to your WordPress Website.
Digital pandaemics are caused when malware, viruses and hackers infect WordPress websites. These are targeted exploits because WordPress infections have the potential to effect over 30% of all websites in the world. Hackers and fraudsters prefer making a bigger impact from creating their various WordPress infections, than to try to infect a website one at a time.
So a reminder that the most robust, feature packed and well used website creation option is also needing regular checks and diligent monitoring to maintain good health and security.
New Windows malware can also brute-force WordPress websites…
Avast discovers strange new malware strain that besides stealing and mining cryptocurrency on infected hosts, it also launches brute-force attacks on WordPress sites.
By Catalin Cimpanu for Zero Day | August 7, 2019 — 11:40 GMT (04:40 PDT) | Topic: Security
A new malware strain named Clipsa has been making the rounds for the past year, infecting users from all over the world.
What stands out about this new threat is that besides classic malware features — such as the ability to steal cryptocurrency wallet files, install a cryptocurrency miner, and hijacking the user’s clipboard to replace cryptocurrency addresses — Clipsa also includes a somewhat strange feature that allows it to launch brute-force attacks against WordPress websites.
This behavior is strange, mainly because most brute-force attacks against WordPress sites are carried out by botnets of infected servers or IoT devices.
Hackers exploit critical vulnerability found in ~100000 WordPress sites
Dan Goodin – Feb 18, 2020 8:08 pm UTC
Hackers are actively exploiting a critical WordPress plugin vulnerability that allows them to completely wipe all website databases and, in some cases, seize complete control of affected sites.
Over 2000 WordPress Sites Hit by Malicious Redirects – Infosecurity …
Thousands of WordPress sites have been infected with malicious JavaScript in an attempt to promote scam websites, according to Sucuri.
The number of infections spiked last week, with hackers exploiting vulnerabilities in various plugins, including Simple Fields and the CP Contact Form with PayPal, the security vendor explained in a blog post.
After exploitation, the hackers are able to inject JavaScript which begins a series of redirects to a fraudulent “survey-for-gifts” website, where users are tricked into handing over personal info and unwittingly installing malware.
Among the domains registered as part of the campaign are gotosecond2[.]com, adsformarket[.]com, admarketlocation[.]com and admarketresearch[.]xyz.
How to Repair WordPress Malware Infections (Step-by-Step Guide)
Twenty steps to clean a site. To be successful, you should be familiar with WordPress core files, FTP and your hosting control panel. If your host provides access to the command shell and you’re familiar with Linux, even better. Let’s get started!
Step 0: Backup your site. Before you even start, if you have a working backup, consider restoring that backup to a time before the malware infection occurred. Your site may still be in a vulnerable state, but it may not be the mess it is right now. If you don’t have a backup, or you need to get your site working with minimal loss since your last backup, you should backup your site before proceeding. I am not responsible for any damages you might cause your site by following this guide. When in doubt, hire a professional.
Step 1: Record plugins and themes. Make a note of everything you’re using, including the URL and author, if available. If it’s not active and/or necessary, consider deleting it. Pay special attention to the active plugins; malicious plugins are often installed with seemingly innocuous names such as, WordPress Dictionary.
Step 2: Download WordPress You’re going to need a fresh copy of the latest version of WordPress.
Step 3: Remove unknown users. Especially user with Administrator access. If they have content associated with them, assign it to a known user.
Step 4: Reset your password. Make it something strong; I just let the auto-generator suggest something.
Step 5: Secure FTP accounts. This is back in your hosting control panel and is actually two steps in one. Some panels give you the option to delete the files under the user as well, but I would not suggest this unless you have a backup and know what you’re doing. Reset the passwords on any remaining FTP accounts to something strong.Step 6: Reset any other logins. Reset any other control panel, billing or additional logins your hosting account might have.
Step 7: Take website offline. I typically do this by renaming the folder, but you could do it with permissions as well. This is one that’s tempting to skip over to minimize downtime. However, if you leave your site up with any active infection, you leave the door open to re-infection while you work. The short downtime will be worth the hassle of having to start over from scratch.
Step 8: Check .htaccess. A commonly targeted file by malware infections. Remove malware redirects manually if you know what you’re doing. If you’re unsure, another option is to delete the file (backup first!) then recreate it through WordPress after you’re done. This is as simple as re-saving the Permalinks settings.
Step 9: Archive core WordPress files. Basically you’re going to backup the old files on-site temporarily. I usually create a temp folder and move the core files there. This does not include the /wp-contents/ folder or wp-config.php.
This is a list of the latest WordPress core files at time of publication:
Step 10: Install fresh plugins and themes. Things start to get tricky here for most people. I like to start with a fresh /plugins/ and /themes/ folder and upload new copies of the plugins straight from WordPress. If you’ve made changes directly to your theme files, re-installing the theme may not may possible. If you have a premium theme or plugin, you will have to retrieve that the source again.
, Step 11: Remove malware. This is where the dirty work happens, and ….
How To Clean Malware Infections In WordPress
If it’ll give you some extra reassurance take a look at this article to become more knowledgeable about the most common kinds of malware infections in WordPress and useful security plugins to fight against them.
If you’ve already been hacked, the good news is that you can clear out the malware infections in WordPress by following the steps we cover in this article. They can be safely done on your own but if you don’t feel comfortable handling it yourself, or if you detect that the hack job is a particularly serious one, you can also hire a removal service like this one.
We’re confident that you can clean you website, get it back to normal and protect it from future attacks. We’ll explain in detail how to do all that in the eight steps below. Let’s begin.
Your site can be infected in various ways and one of the most common ways is when your computer has a virus that is leaking your site’s FTP password. So the first thing you need to do is to check that your computer is virus-free.
Scan your computer with antivirus software on an updated virus signature database. As you’ll learn after reading this article, one of the best ways of preventing hacks is by keeping everything updated – including your antivirus software.