Over 1,000 WordPress Sites Infected with JavaScript Backdoors Enabling Persistent Attacker Access
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-20720 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Comma Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. NVD description · AI analysis pending | 9.1 | 4% |
| — | ||
| CVE-2024-34102 | XXE vulnerability enabling RCE in Adobe Commerce and Magento Open Source CVE-2024-34102 is an improper restriction of XML external entity reference (XXE) vulnerability (CWE-611) in Adobe Commerce and Magento Open Source, where the platform does not properly restrict external entities when processing XML, so an attacker who can submit crafted XML containing external entity references can have it parsed with attacker-controlled resources. XXE flaws classically enable local file disclosure and server-side request forgery, and in this case Adobe states the flaw allows remote code execution on the affected server. Any organization running a vulnerable Adobe Commerce or Magento Open Source storefront is affected, and because these are internet-facing e-commerce platforms that routinely process XML input, exposure is likely to be broad. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2024-07-17, confirming exploitation in the wild, and its EPSS score of ~100% (100th percentile) indicates near-certain near-term exploitation activity; no public proof-of-concept is known and CVSS has not yet been scored. CISA lists ransomware use as unknown, so a ransomware connection should not be assumed. Do: Apply Adobe's security updates for Adobe Commerce and Magento Open Source per the vendor's June 2024 advisory (APSB24-40), or, per the CISA KEV required action, apply vendor-recommended mitigations or discontinue use of the product if patches are unavailable. Review any endpoints or integrations that accept XML from untrusted users and hunt for signs of XXE exploitation, such as unexpected outbound requests, anomalous file reads, or webshell artifacts. Continue monitoring Adobe and CISA KEV for updated mitigation guidance and remediation deadlines. | 9.8 | 100% | KEV PoC |
| mass≈150,000+ storefronts (public technology scans report on the order of 100k-250k live Magento-based sites) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | csyndication.com | licious JavaScript code has been found to be served via cdn.csyndication[.]com. As of writing, as many as 908 websites contain reference |
| domain | gsocket.io | to execute remote commands and fetches another payload from gsocket[.]io to likely open a reverse shell To mitigate the risk posed |
| domain | jbwzzzjs.com | e redirects - mlbetjs[.]com ptfafajs[.]com zuizhongjs[.]com jbwzzzjs[.]com jpbkte[.]com The findings also follow a new report from G |
| domain | jpbkte.com | lbetjs[.]com ptfafajs[.]com zuizhongjs[.]com jbwzzzjs[.]com jpbkte[.]com The findings also follow a new report from Group-IB about |
| domain | mlbetjs.com | the main payload responsible for performing the redirects - mlbetjs[.]com ptfafajs[.]com zuizhongjs[.]com jbwzzzjs[.]com jpbkte[.]c |
| domain | ptfafajs.com | ad responsible for performing the redirects - mlbetjs[.]com ptfafajs[.]com zuizhongjs[.]com jbwzzzjs[.]com jpbkte[.]com The findings |
| domain | zuizhongjs.com | for performing the redirects - mlbetjs[.]com ptfafajs[.]com zuizhongjs[.]com jbwzzzjs[.]com jpbkte[.]com The findings also follow a ne |
Full article463 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 06, 2025Data Breach / Website Security
Over 1,000 websites powered by WordPress have been infected with a third-party JavaScript code that injects four separate backdoors.
"Creating four backdoors facilitates the attackers having multiple points of re-entry should one be detected and removed," c/side researcher Himanshu Anand said in a Wednesday analysis.
The malicious JavaScript code has been found to be served via cdn.csyndication[.]com. As of writing, as many as 908 websites contain references to the domain in question.
The functions of the four backdoors are explained below -
- Backdoor 1, which uploads and installs a fake plugin named "Ultra SEO Processor," which is then used to execute attacker-issued commands
- Backdoor 2, which injects malicious JavaScript into wp-config.php
- Backdoor 3, which adds an attacker-controlled SSH key to the ~/.ssh/authorized_keys file so as to allow persistent remote access to the machine
- Backdoor 4, which is designed to execute remote commands and fetches another payload from gsocket[.]io to likely open a reverse shell
To mitigate the risk posed by the attacks, it's advised that users delete unauthorized SSH keys, rotate WordPress admin credentials, and monitor system logs for suspicious activity.
The development comes as the cybersecurity company detailed another malware campaign has compromised more than 35,000 websites with malicious JavaScript that "fully hijacks the user’s browser window" to redirect site visitors to Chinese-language gambling platforms.
"The attack appears to be targeting or originating from regions where Mandarin is common, and the final landing pages present gambling content under the 'Kaiyun' brand.
The redirections occur through JavaScript hosted on five different domains, which serves as a loader for the main payload responsible for performing the redirects -
- mlbetjs[.]com
- ptfafajs[.]com
- zuizhongjs[.]com
- jbwzzzjs[.]com
- jpbkte[.]com
The findings also follow a new report from Group-IB about a threat actor dubbed ScreamedJungle that injects a JavaScript code named Bablosoft JS into compromised Magento websites to collect fingerprints of visiting users. More than 115 e-commerce sites are believed to be impacted to date.
The injected script is "part of the Bablosoft BrowserAutomationStudio (BAS) suite," the Singaporean company said, adding it "contains several other functions to collect information about the system and browser of users visiting the compromised website."
It's said that the attackers are exploiting known vulnerabilities affecting vulnerable Magento versions (e.g., CVE-2024-34102 aka CosmicSting and CVE-2024-20720) to breach the websites. The financially motivated threat actor was first discovered in the wild in late May 2024.
"Browser fingerprinting is a powerful technique commonly used by websites to track user activities and tailor marketing strategies," Group-IB said. "However, this information is also exploited by cybercriminals to mimic legitimate user behavior, evade security measures, and conduct fraudulent activities."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/over-1000-wordpress-sites-infected-with.html