Another cyber attack is reported. Cybersecurity experts have identified a large campaign. The campaign injected dangerous JavaScript code into the WordPress websites. In addition, malicious JavaScript sends visitors to scam pages or other harmful websites.
The malicious JavaScript infected all websites’ files and databases, including the genuine core WordPress files, according to Sucuri’s malware analyst, Mr Krasimir Konov.
WordPress Sites Injected with Malicious
Infected files included jquery.min.js and jquery-migrate.min.js, which run on every page load. The malware would redirect the website visitor to the attacker’s choice.
The malicious JavaScript can simply redirect the chain and be used to load ads, phishing pages, viruses or malware or even initiate a circle of subsequent redirects, according to the GoDaddy security company.
This wave of cyber-attacks appears to be a continuation of last month’s wave. Since May 9th, the cyberattack has hit 322 websites. The April attack hit around 6,500 websites.
Due to malicious JavaScript, users are sometimes sent to a bogus CAPTCHA check page. The unwanted malicious adverts are concealed in the CAPTCHA check, and the viewer thinks it is a security check run by the operating system.
Mr Konov, a malware analyst, stated that these attacks target WordPress’ weak points and vulnerabilities. The malicious scripts are injected into the website’s themes and plugins.
