Linux malware leverages plugin exploits to backdoor WordPress sites

Threat Level

Attack Report

For a detailed threat advisory, download the pdf file here

Summary

WordPress sites are being exploited by an unidentified strain of Linux malware that exploits flaws in plugins and compromises the sites by injecting malicious JavaScripts that are run sequentially until one of them succeeds. The malware targets both 32-bit and 64-bit Linux systems, enabling the malicious user to execute commands remotely.