Over 4,500 WordPress Sites Hacked to Redirect Visitors to Sketchy Ad Pages

Jan 25, 2023Ravie LakshmananWebsite Security / WordPress

A massive campaign has infected over 4,500 WordPress websites as
part of a long-running operation that’s been believed to be active
since at least 2017.

According to GoDaddy-owned Sucuri, the infections involve the
injection of obfuscated JavaScript hosted on a malicious domain
named “track[.]violetlovelines[.]com” that’s designed to redirect
visitors to unwanted sites.

The latest operation^[1]
is said to have been active since December 26, 2022, according to
data^[2]
from urlscan.io. A prior wave seen in early December 2022^[3]
impacted more than 3,600 sites, while another set of attacks
recorded in September 2022^[4]
ensnared more than 7,000 sites.

The rogue code is inserted in the WordPress index.php file, with
Sucuri noting that it has removed such changes from more than
33,000 files on the compromised sites in the past 60 days.

“In recent months, this malware campaign has gradually switched
from the notorious fake CAPTCHA push notification scam pages to
black hat ‘ad networks’ that alternate between redirects to
legitimate, sketchy, and purely malicious websites,” Sucuri
researcher Denis Sinegubko said^[5].

Thus when unsuspecting users land on one of the hacked WordPress
sites, a redirect chain is triggered by means of a traffic
direction system, landing the victims on pages serving sketchy ads
about products that ironically block unwanted ads.

Even more troublingly, the website for one such ad blocker named
Crystal Blocker is engineered to display misleading browser update
alerts to trick the users into installing its extension depending
on the web browser used.

The browser extension is used by nearly 110,000 users spanning
Google Chrome^[6]
(60,000+), Microsoft Edge^[7]
(40,000+), and Mozilla Firefox^[8]
(8,635).

“And while the extensions indeed have ad blocking functionality,
there is no guarantee that they are safe to use — and may contain
undisclosed functions in the current version or in future updates,”
Sinegubko explained.

Some of the redirects also fall into the outright nefarious
category, with the infected websites acting as a conduit for
initiating drive-by downloads.

This also includes retrieving from Discord CDN an
information-stealing malware known as Raccoon Stealer, which is
capable of plundering sensitive data such as passwords, cookies,
autofill data from browsers, and crypto wallets.

The findings come as threat actors are setting up^[9]
lookalike^[10] websites^[11] for a variety of
legitimate software to distribute stealers and trojans^[12] through malicious ads
in Google search results.

Google has since stepped in to block one of the rogue domains^[13] involved in the
redirect scheme, classifying it as an unsafe site that installs
“unwanted or malicious software on visitors’ computers.”

To mitigate such threats, WordPress site owners are advised to
change passwords and update installed^[14] themes and plugins^[15] as well as remove those
that are unused or abandoned by their developers.