Cybersecurity researchers have uncovered a campaign targeting WordPress sites with malicious JavaScript injections leading to site redirection and malware distribution. The campaign uses sophisticated techniques like remote payload loading and cache smuggling to evade detection and deliver malicious content, emphasizing the importance of securing WordPress environments and implementing strong security measures. #WordPressSecurity #ClickFixAttack
Keypoints
- Attackers inject malicious JavaScript into WordPress theme files, such as “functions.php”.
- The malicious code utilizes remote loading from domains like “porsasystem.com” and “brazilc.com”.
- The campaign employs advanced techniques like cache smuggling to evade detection.
- Threat actors create customizable phishing pages using tools like IUAM ClickFix Generator.
- The attacks often lead to malware delivery and data theft, targeting both Windows and macOS systems.
Read More: https://thehackernews.com/2025/10/hackers-exploit-wordpress-themes-to.html