[su_heading size=”18″ margin=”30″]A new Exploit Kit – which appears as a Social Sharing Plugin, thus hiding its malicious nature – has managed to infect a significant number of WordPress & Joomla websites in a short period of time. [/su_heading]
Security researchers at MalwareBytes recently uncovered a new trick exploited by cybercriminals, who, after implanting malicious code on websites with security vulnerabilities, through the use of specially selected domains, trick webmasters into thinking that the code that mysteriously appeared on their site is part of a social sharing plugin.
For this trick to work, attackers must first compromise and gain access to the website. Malwarebytes researchers say they have already identified a significant number of Joomla and WordPress that have been affected by this type of scam. Once the attackers manage to compromise a website, they add malicious Javascript code to the source code, which calls a JS of the form: “https://social-button.site/analytics.js”, while other corresponding domains such as “socialplugin.io” are also used.
With a quick inspection of the code, administrators will see a simple JavaScript file without malicious intent, which simply refers to a social networking plugin.
However, when users visit the infected website, the code will be loaded into their browser and replaced with something more dangerous. This particular malicious version of the so-called “social sharing analytics” javascript code will redirect users to a series of intermediate sites before finally landing on a page hosting the Angler exploit kit.
If users are using an older browser version or outdated browser add-ons, the Angler exploit kit will execute malicious processes, further infecting devices with the Bedep click-fraud malware.
