The Download
Security research firm Sucuri says over 39,000 websites have been compromised with Sign1 malware that exploits WordPress plug-ins. Not only are the websites comromised, but visitors to the sites can be infected or scammed by the malware. It is believed that the compromise occurs by exploiting WordPress plug-in vulnerabilities and brute force hacking. The hackers then inject simple CSS and JS plugin to the website to run malicious Javascript to visiting clients. The scripts redirect visitors to fake and scam websites as well as generate unwanted pop-ups.
What You Can Do
Websites provide fairly rich interfaces such as WordPress with vulnerabilities that can be exploited. The richness allows dynamic content and a visually appealing visitor experience, but also provides a lot of attack surface area for hackers.
You should be pen testing your website regularly for vulnerabilities in WordPress and other plug-ins as well as understand its susceptibility to brute-force hacks. ThreatMate will automatically pen test your website weekly to test for any new vulnerabilities that may present attractive targets to hackers.
To learn more: