WP3.XYZ Malware Hijacks 5,000+ WordPress Sites with Rogue Admins
A newly discovered malware campaign has compromised over 5,000 WordPress sites using WP3.XYZ malware, creating rogue admin accounts, installing malicious plugins, and exfiltrating sensitive data.
Malware Activity Overview
Researchers at web security firm c/side identified the campaign during an incident response investigation for a client. The attacks center around the malicious domain wp3[.]xyz, used to deploy scripts and exfiltrate data.
Key Steps in the Attack
Rogue Admin Account Creation
- A malicious script loaded from wp3[.]xyz creates an admin account named wpx_admin.
- Credentials for this account are hard-coded in the malware script.
Creating a rogue admin account
Source: c/sideMalicious Plugin Deployment
- The script downloads and activates a plugin named plugin.php from the same domain.
- This plugin collects sensitive data such as administrator credentials and activity logs.
- Data exfiltration is disguised as image requests to evade detection.
Verification Mechanism
- The malware verifies successful creation of the rogue admin account and plugin installation, logging the operation status for attackers.
Creating a rogue admin accountSee Also: So, you want to be a hacker?
Offensive Security, Bug Bounty Courses
Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.
Mitigation and Protection Strategies
To protect WordPress sites from this malware campaign, c/side recommends the following actions:
- Block Malicious Domains
- Use firewalls or security tools to block access to wp3[.]xyz and other known malicious domains.
- Audit User Accounts and Plugins
- Regularly review privileged accounts to identify and remove unauthorized users like wpx_admin.
- Examine installed plugins and delete any unauthorized or suspicious entries.
- Enhance Cross-Site Request Forgery (CSRF) Protections
- Implement unique token generation for requests.
- Enable server-side validation of tokens.
- Use periodic regeneration of tokens with short expiration times to reduce their effectiveness if stolen.
- Strengthen Authentication
- Enable multi-factor authentication (MFA) for administrator accounts to reduce the risk of credential-based attacks.
Trending: Offensive Security Tool: XSRFProbe
Additional Recommendations
- Keep WordPress installations and plugins updated to patch known vulnerabilities.
- Monitor server logs for unusual activity, including unexpected image requests.
- Conduct regular security assessments to identify and mitigate weak points in your website’s infrastructure.
Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]
Source: bleepingcomputer.com
Recent News
Offensive Security & Ethical Hacking Course
Begin the learning curve of hacking now!
Information Security Solutions
Find out how Pentesting Services can help you.
