A years-long campaign by miscreants to insert malicious JavaScript into vulnerable WordPress sites, so that visitors are redirected to scam websites, has been documented by reverse-engineers.
An investigation by analysts at Sucuri into malware found on WordPress installations revealed a much larger and ongoing campaign that last month, we’re told, hijacked more than 6,600 websites. The team has seen a spike in complaints this month related to the intrusions, according to analyst Krasimir Konov.
“The websites all shared a common issue — malicious JavaScript had been injected within their website’s files and the database, including legitimate core WordPress files,” Konov wrote.
Those included such files as ./wp-includes/js/jquery/jquery.min.js and ./wp-includes/js/jquery/jquery-mgrate.min.js. Essentially, miscreants are compromising websites, and then try to automatically inject their own malicious code into any .js files with jQuery in the filename.
They also used CharCode to obfuscate the malicious JavaScript and evade detection. The obfuscated software is active on every page that pulls in the vandalized jQuery library files, enabling the attacker to redirect the site’s visitors to whatever destination they choose. And that’s usually phishing pages, malware-laced downloads, ad banners, or even more redirects, we’re told.
To do this, the malicious injection creates a new script element on the page with a domain of legendarytable[.]com as the source. The code from that domain calls out to second external domain – local[.]drakefollow[.]com – which calls out to another one, setting up a series of domains the visitor is sent through until they’re redirected to a site of one of many different domains.
“At this point, it’s a free for all,” Konov wrote. “Domains at the end of the redirect chain may be used to load advertisements, phishing pages, malware, or even more redirects.”
Before landing on the final destination page, some visitors are sent to a fake CAPTCHA page, which tries to trick them into subscribing to push notifications from the malicious site.
“If they click on the fake CAPTCHA, they’ll be opted in to receive unwanted ads even when the site isn’t open — and ads will look like they come from the operating system, not from a browser,” he wrote.
“These sneaky push notification opt-in maneuvers also happen to be one of the most common ways attackers display ‘tech support’ scams, which inform users that their computer is infected or slow and they should call a toll-free number to fix the problem .”
WordPress powers about 43 percent of the websites on the internet, according to W3Techs, but that also makes it a popular target for bad actors. About 90 percent of the requests they get for cleaning up a website were related to WordPress, with malicious redirects being the result of some of the most common malware infections, Sucuri said.
“As new vulnerabilities in WordPress plugins are discovered, we anticipate that they will be caught up in the massive ongoing redirect campaign sending unsuspecting victims to fraudulent websites and tech support scams,” they wrote. ®