According to security firm Sophos, a major malware campaign now underway is using insecure WordPress sites (not up-to-date secured sites) to install harmful software on the computers of unwitting visitors.
The campaign works like this:
- An email is sent to a random person with the subject line, “Verify your order.”
- In the email is a link to a malware-infected WordPress site. (These are legitimate sites that have been compromised.)
- Clicking on the link takes the person to the infected site, and an attempt is made to install malware onto the visitor’s PC by using the Blackhole Exploit Kit.
The emails, says Sophos, typically take the following form:
Subject: Verify your order
Dear [name], please verify your order #[random number] at [LINK]
We hope to see you again soon!
Featured Plugin - WordPress Newsletter Plugin
According to Sophos, they have detected the following malware in relation to this current campaign: Troj/PDFEx-GD, Troj/SWFExp-AI, Mal/ExpJS-N and Troj/Agent-XDM.
It should be repeated that this is not an issue with the current version of WordPress, and so it is recommended to make sure you have the latest version of WordPress, as well as up-to-date versions of all your plugins.
A quick and easy place to check your site for malware is Sucuri.net’s site-check page.
Featured Plugin - WordPress Wiki Plugin
Photo: Other Danger Sign from BigStock