I've used wordpress blogs as content management for a long, long time. I guess I do get a lot of traffic and still get some hits on old posts even though I don't post much any more.

Someone was able to brute force a password and create an administrator user. This allowed them to install plugins that don't show on the plugin list and put obfuscated malware scripts on each page. It was causing the links to be redirected.

I guess I just didn't have enough to do today.

I seem to have cleaned the garbage and I've password protected the admin directory, changed all passwords, everywhere.

There was really no gain to the hack that I could imagine. It's just malicious for being malicious. Jerks!

If you run a wordpress blog, check for injected scripts in the markup that shouldn't be there.

That sucks.

On a positive note, if you survive the snowpocalypse your website will be in great shape for spring.

Speaking of snowpocalypse. Were schools shutdown today. You mentioned it was malicious just for being malicious and it might be bored teens.

Wordpress has long been notorious as full of holes. They found yours.

The point wasn’t to gain something from you directly, other than free malware hosting. Just another drone in the army.

Maybe its time I went to two-step authentication ...

Keylogger on Thousands of Infected WordPress Sites

https://blog.sucuri.net/2017/1...wordpress-sites.html

quote:

Someone was able to brute force a password and create an administrator user. This allowed them to install plugins that don't show on the plugin list and put obfuscated malware scripts on each page. It was causing the links to be redirected.

I'll take your word for it.

I had the same thing happen - after getting it back up and running I installed the free version of https://www.wordfence.com/ and haven't had any other issues since.

Is this associated with wordpress.org, self-hosted sites?

Or wordpress.com-hosted sites? The .com sites do not have great ability to manipulate code. Some, but not a lot.

quote:

Originally posted by BamaJeepster:
I had the same thing happen - after getting it back up and running I installed the free version of https://www.wordfence.com/ and haven't had any other issues since.

I came across that in the early morning and installed it on two sites so far. Thanks.

Oh, I also password protected the wp-admin directories.

UGh. Been there. Still have 3 sites down that I don't have time to fix.

We're considering moving away from WP...and doing something simpler.

I've used securi, but honestly...its just a PITA, and costs money. The hackers still get through it. Our veterans outreach site was under constant attack, and we finally gave up and went back to facebook with it.

quote:

Originally posted by Woodman:
Maybe its time I went to two-step authentication ...

Yup!

https://en.support.wordpress.c...step-authentication/

You should have 2FA on ALL of your accounts.