WordPress Theme Injection Loads Malicious Scripts Across at Least 17 Websites
Summary
An injected function in a WordPress theme’s functions.php file fetched attacker-controlled JavaScript, enabling redirects and pop-ups. The researchers found the script loading on at least 17 websites and shared two indicators of compromise.
Key points
- Malicious PHP injected into a theme’s functions.php ran on each page load through wp_head and fetched remote content.
- The remote payload used brazilc[.]com and loaded JavaScript from porsasystem[.]com to drive redirects and pop-ups.
- The researchers found the script loading on at least 17 websites; VirusTotal showed the domain was blocklisted by 17 security vendors.
- The payload created a hidden 1×1 iframe and mimicked a Cloudflare challenge script as an evasion technique.
- Visitors could be exposed to injected content, including fake Cloudflare verification.
- Remediation includes removing injected code, checking for other backdoors, updating software, using strong unique passwords, monitoring logs and file changes, and deploying a WAF.
Article Details
- Attack Vectors
- Injected PHP in the active WordPress theme’s functions.php fetched JavaScript from attacker-controlled domains and inserted it into website pages.
- The injected JavaScript loaded redirect and pop-up scripts, and created a hidden iframe containing code that mimicked a Cloudflare action.
- Defensive Notes
- Keep website software, plugins, and themes—and visitor browsers and operating systems—up to date.
- Scan server and client environments regularly for malware, backdoors, and injected code; monitor logs and consider file integrity monitoring.
- Use unique passwords for accounts including sFTP, database, cPanel, and administrator accounts.
- Consider a web application firewall.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | brazilc[.]com | Attacker-controlled C&C domain contacted by the injected PHP code. |
| DOMAIN | porsasystem[.]com | Malicious script-hosting domain described as a traffic distributor for redirect and pop-up scripts. |
| URL | hxxps[:]//brazilc[.]com/ads.php | C&C endpoint that returned malicious content to the injected code. |