Saturday, May 17, 2025
HomeMalwareOver 700 WordPress and Joomla Websites Infected with IonCube Malware

Over 700 WordPress and Joomla Websites Infected with IonCube Malware

Published on

SIEM as a Service

Follow Us on Google News

New Ioncube Malware found on hundreds of WordPress and Joomla websites that infect with legitimate Ioncube encoded files.

IonCube is a PHP Encoder that used for Encrypt and protect files with PHP encoding, encryption, obfuscation and licensing capabilities.

This Malware infection discovered in both WordPress and Joomla websites along with thousands of files and it infect the files such as “diff98.php” and “wrgcduzk.php” which is core directories of a WordPress site.

- Advertisement - Google News

IonCube malware is used by hackers to create backdoor on vulnerable websites allowing them to steal data from the Victims.

Also Read: Penetration testing with your WordPress Website-Detailed Explanation

IonCube Malware with WordPress and Joomla 

Initially researchers discovered IonCube Malware WordPress site files that encoded with ionCube, which is one of the oldest and most difficult to reverse PHP obfuscation technologies.

Later further analysis revealed that, it infected Joomla and CodeIgniter sites and this malware visible in almost  any web server running PHP.

So Over all, researchers found over 700 infected sites, totalling over 7,000 infected files.

According to sitelock It was also found that the files were not consistently following malicious naming patterns – innocuous files with names such as “inc.php” and “menu.php” also contained this malware.

Fake IonCube files completely pretending as legitimate IonCube files.

Fake ionCube File

Legitimate ionCube File

In this case, Few line exists in the legitimate ionCube file, but not the fake one, and should be present in all recent, legitimate ionCube files.

Every Legitimate Ioncube files reference to the ioncube.com domain but it is not present in the fake files.

“Also researchers notice that the fake file has a code block after the PHP closing tags, much like the legitimate ionCube file. But unlike the real file, this code block consists only of alphanumeric characters and newlines.”

Mitigation by SiteLock

If you or your developer have not specifically and intentionally installed ionCube-encoded files, it is likely that any files claiming to be using ionCube are suspicious, as successfully making use of ionCube typically requires manual server configuration.

Also, cross-compatibility with different versions of PHP is minimal, reducing the viability of use as malware.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

VMware ESXi, Firefox, Red Hat Linux & SharePoint Hacked – Pwn2Own Day 2

Security researchers demonstrated their prowess on the second day of Pwn2Own Berlin 2025, discovering...

Critical WordPress Plugin Flaw Puts Over 10,000 Sites of Cyberattack

A serious security flaw affecting the Eventin plugin, a popular event management solution for...

Sophisticated NPM Attack Leverages Google Calendar2 for Advanced Communication

A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign...

New Ransomware Attack Targets Elon Musk Supporters Using PowerShell to Deploy Payloads

A newly identified ransomware campaign has emerged, seemingly targeting supporters of Elon Musk through...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Printer Company Distributes Malicious Drivers Infected with XRed Malware

Procolored, a printer manufacturing company, has been found distributing software drivers infected with malicious...

Frigidstealer Malware Targets macOS Users to Harvest Login Credentials

An macOS users, a new information-stealing malware dubbed FrigidStealer has emerged as a formidable...

SSH Auth Key Reuse Uncovers Advanced Targeted Phishing Campaign

A meticulously orchestrated phishing campaign targeting Kuwait's fisheries, telecommunications, and insurance sectors has been...