Redirector hack code#

The most interesting scenario is when you use Internet Explorer. We detected the following domains were used in the redirect chains: Depending on the IP and the browser, the visitor gets redirected further. com is not the final redirect destination. The chances of the redirect are specified in the $chance variable, which is currently set to 15%.ĭefault7. Random WordPress RedirectsĮven for eligible visitors, the redirects are random. If they are not search engine crawlers, it checks the user agent header. com if it’s their first visit to this site after the infection, then it sets the 896diC9OFnqeAcKGN7fW cookie for one year to track returning visitors. When decoded, you see this main part of the malware: Decoded malware

Redirector hack code#

In all cases, the malware injects 10-12 lines of code at the top of the header.php file of the current WordPress theme: Malicious injection in header.php In this post, we’ll provide you with a review of this attack, investigated by our malware analyst, John Castro. We’ve been working on a few WordPress sites with the same infection that randomly redirects visitors to malicious sites via the default7. In addition, it shows how hackers make redirects random, which hinders detection. Although the attack is not active for the last three years, it shows the most common techniques used by hackers: malware in theme’s header.php, conditions on the first visit and type of the browser. The following case from 2016 is a typical example of a conditional server-side WordPress redirect.

Default browser language – For example, some spam campaigns redirect only visitors whose browsers report Japanese or Korean as their preferred language.First visit or not – Malware usually lurks on subsequent visits to make it harder to detect and troubleshoot.Mobile or not – Only mobile traffic may be redirected.Type of web browser – The malware exploits a vulnerability in a certain browser, and hackers are not interested in visitors that use other types of browsers.For example, search traffic redirects only take place when visitors come from Google search results or from some other search engine.

It means that redirection only occurs when a certain condition is met. Most malicious redirects are conditional. The most common client-side redirects are implemented via injected JavaScript code (unwanted ads or redirects to scam sites) or via the HTML “meta refresh” instruction (typical for phishing pages). htaccess files or PHP code injected into legitimate files.Ĭlient-side redirects are initiated by visitors’ browsers after they load infected web pages. The most common techniques used by server-side redirect hacks are “rewrite” rules in Apache. Server-side redirects take place before a visitor even loads a page. There are two major types of malicious redirects: server-side redirects and client-side redirects. counterfeit drugs or replica merchandise). Malicious redirect is a type of hack where website visitors are automatically redirected to some third-party website: usually it’s some malicious resource, scam site or a commercial site that buys traffic from cyber criminals (e.g.