We saw randomized injections and obfuscation types, simultaneous use of multiple domains and subdomains, abuse of CloudFlare, and multiple approaches to attack administrators of infected WordPress sites. We observed a rapid cycle of modifications to their injected scripts alongside new techniques and approaches. More than 9,000 of the new infections were the result of injections made possible by exploiting CVE-2023-3169. Last month, Sucuri detected Balada injections on more than 17,000 sites, almost double the number the firm had seen the month before. Sucuri estimates that in the past six years, Balada has compromised more than 1 million sites. Sucuri, the security firm Sinegubko works for, has been tracking the malware campaign since 2017 and has named it Balada.

The redirections lead to sites pushing fake tech support, fraudulent lottery wins, and push notification scams, the latter of which trick visitors into subscribing to push notifications by displaying fake captcha dialogs.

It was partially fixed in tagDiv Composer version 4.1 and fully patched in 4.2.Īccording to a post authored by security researcher Denis Sinegubko, threat actors are exploiting the vulnerability to inject web scripts that redirect visitors to various scam sites. Discovered by Vietnamese researcher Truoc Phan, the vulnerability carries a severity rating of 7.1 out of a possible 10.

Tracked as CVE-2023-3169, the vulnerability is what’s known as a cross-site scripting (XSS) flaw that allows hackers to inject malicious code into webpages. The themes are available through the Theme Forest and Envato marketplaces and have more than 155,000 downloads. The vulnerable plugin, known as tagDiv Composer, is a mandatory requirement for using two WordPress themes: Newspaper and Newsmag. Thousands of sites running the WordPress content management system have been hacked by a prolific threat actor that exploited a recently patched vulnerability in a widely used plugin.

Instaling Chromium 117.0.5924.0