DMasti Network: Backdoors

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: justify;">What would you do when you receive an email offering Pro version of Wordpress plugin for free, if you are a WordPress user? Don't get tempted by such kind of emails, they also give malicious code for free!<br /><br />Sucuri <a href="http://blog.sucuri.net/2013/12/phishing-emails-to-install-malicious-wordpress-plugins.html" target="_blank">reported</a> about a phishing emails asking their clients to download Pro-version of "All in one SEO Pack" WordPress plugin.  The email claims that the plugin is $79.00 worth and giving it for free.<br /><br />"You have been chosen by WordPress to take part in our Customer Rewarding Program.  You are the 23rd from 100 <i style="color: red;">uniques</i> winners." The phishing email reads.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil0FFW-n-B9G1FIafXYqT-Ox7kSFVYDAeXhLzyU6bFGAGORucbz5c011VMjvu6d5C086PMvRfviy2ChAPbRXuqxtt31x_eNG3V9mcrhSr-6E6_cmU-V6vEldBWMImgCGwpGY5yvzRiFns/s400/phishing-email-malicious-wordpress-plugin.jpg" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="273" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil0FFW-n-B9G1FIafXYqT-Ox7kSFVYDAeXhLzyU6bFGAGORucbz5c011VMjvu6d5C086PMvRfviy2ChAPbRXuqxtt31x_eNG3V9mcrhSr-6E6_cmU-V6vEldBWMImgCGwpGY5yvzRiFns/s400/phishing-email-malicious-wordpress-plugin.jpg" width="320" /></a>The download link provided in the email is not linked to WordPress plugin store, it is linked to a zip file hosted in a compromised website.<br /><br />Security researchers at Sucuri analyzed the plugin and found out that it is modified with a Backdoor which gives attackers full access to the server.<br /><br />The malicious code in the plugin replaces the index.php file with the malicious code retrieved from the attacker's server.  So, when user visit the site, they either redirected to SPAM sites or to Exploit kits where it will infect the visitor's system.</div><br /><br />Dated: Thursday, December 5, 2013<br /><br /><br /></div>

WordPress Plugins containing Backdoor distributed via phishing emails

What would you do when you receive an email offering Pro version of Wordpress plugin for free, if you are a WordPress user? Don't get te...