Latest Mass Compromise of WordPress sites – More Details

We are getting lots of questions about the latest mass compromise targeting WordPress sites (redirecting to fake AV) that has affected over 30,000 domains.

The first question is how are these sites getting hacked? On all the cases we analysed, they either had outdated versions of WordPress, or of a plugin. We can safely rule out any new vulnerability on WordPress itself.

We also posted about it a week ago when we detected this malware campaign using domains.

As we promised in the previous post, this is an update to what we are seeing.

More Details

  • The malicious domains are still pointing to and (same IP’s used by the group behind the and attacks)
  • More than 200 different domains are being used
  • We have identified more than 500 variations of the injected URL to random domains names in the TLD:

If you’re not sure if you’re infected, do a free website malware scan using SiteCheck

Read more: Latest Mass Compromise of WordPress sites – More Details

Incoming search terms

Story added 11. March 2012, content source with full text you can find at link above.