Thousands of legitimate WordPress sites are serving malware

Sucuri has noticed a spike in the number of compromised websites as part of a malware campaign which relies on thousands of compromised WordPress sites.

According to security experts at Sucuri, threat actors have hijacked thousands of websites running the WordPress CMS to serve malware.

The technique is not new, legitimate compromised websites host malicious exploits used by crooks to serve malware, they are also being used to redirect visitors to a server hosting the popular Nuclear exploit kit, which is very popular in the criminal ecosystem.

The novelty of this last investigation conducted by Sucuri is that the campaign began 15 days ago, the researchers noticed a spike over the past 48 hours  in the number of compromised websites that passed from about 1,000 per day on Tuesday to close to 6,000 on Thursday. On Thursday, Sucuri discovered thousands of compromised sites, 95 percent of which are running on WordPress. The experts are still investigating how the hackers compromised them, they suspect the attackers exploit vulnerabilities in WordPress plugins. Bad news for website administrators, 17 percent of the hacked websites has been blacklisted by a Google service.

“We are seeing a large number of WordPress sites compromised with the “visitorTracker_isMob” malware code. This campaign started 15 days ago, but only in the last few days have we started to see it gain traction; really affecting a large number of sites.

Here is a quick snapshot of what we’re seeing with the infection rates over the past two weeks, but the most interesting trend is over the past 48 hours, as it has grown significantly.” explained Daniel Cid, CTO of security firm Sucuri, in a blog post.

When victims visit a compromised website, the malicious code it hosts tries a number of different exploits depending on the operating system and available apps running on the device.

“This malware campaign is interesting, its final goal is to use as many compromised websites as possible to redirect all their visitors to a Nuclear Exploit Kit landing page. These landing pages will try a wide variety of available browser exploits to infect the computers of unsuspecting visitors.” continues the post.

The websites compromised in the campaign present the following code in all javascript files they include:

function visitorTracker_isMob( ){
var ua = window.navigator.userAgent.toLowerCase();
if(/(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge |maemo|mi..|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc .. |vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-/i.test(ua.substr(0,4))) {
return true;
return false;
} /* .. visitorTracker .. */ /*

The security firm has dubbed the campaign “VisitorTracker,” because one of the function names used in a malicious code is visitorTracker_isMob().

Sucuri researchers discovered that threat actors behind the malware campaign have managed to compromise security provider Coverity and are exploiting it to redirect victims to compromised website.

Sucuri urges administrators to check evidence of the infection on their website, they can use the Sucuri scanning tool to check if their site is affected by this ongoing campaign.

Pierluigi Paganini

(Security Affairs – WordPress, hacking)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Wikileaks founder Julian Assange is free

WikiLeaks founder Julian Assange has been released in the U.K. and has left the country…

5 hours ago

CISA confirmed that its CSAT environment was breached in January.

CISA warned chemical facilities that its Chemical Security Assessment Tool (CSAT) environment was compromised in…

9 hours ago

Threat actors compromised 1,590 CoinStats crypto wallets

Threat actors breached 1,590 cryptocurrency wallets of the cryptocurrency portfolio management and tracking platform CoinStats.…

22 hours ago

Experts observed approximately 120 malicious campaigns using the Rafel RAT

Multiple threat actors are using an open-source Android remote administration tool called Rafel RAT to target Android…

1 day ago

LockBit claims the hack of the US Federal Reserve

The Lockbit ransomware group announced that it had breached the US Federal Reserve and exfiltrated…

1 day ago

Ransomware threat landscape Jan-Apr 2024: insights and challenges

Between Jan and Apr 2024, the global ransomware landscape witnessed significant activity, with 1420 ransomware…

1 day ago

This website uses cookies.