Malware

New Malware Variants Serve Bogus CloudFlare DDoS Captcha

When attackers shift up their campaigns, change their payload or exfiltration domains, and put some extra effort into hiding their malware it’s usually a telltale sign that they are making some money off of their exploits. One such campaign is the fake CloudFlare DDoS pages which we reported on last month. The attack is simple:

[ Read More ]

A Guide to Virtual Patching for Website Vulnerabilities

All software has bugs — but some bugs can lead to serious security vulnerabilities that can impact your website and traffic. Vulnerabilities can be especially dangerous when your software is running over the web, since anyone can reach out and try to attack it. That’s why keeping your website up-to-date with the latest patches and

[ Read More ]

Magento Supply Chain Attack Targets Extension Developer FishPig

Magento store owners using the popular FishPig extensions should be wary of a recent supply chain attack which compromised their software repository. FishPig released a detailed security announcement on September 13th, 2022. The attack is estimated to have occurred on or before August 19th of this year so any eCommerce stores which have installed FishPig

[ Read More ]

How Are Favicon (.ico) Files Used in Website Malware?

When a website is hacked symptoms can sometimes include unexpected, unfamiliar and strangely located favicon or .ico files. Other symptoms might include: ”This site may be hacked” warnings Strange redirects to spam websites Blocklisting by Google, Bing and other search authorities Randomly named folders containing spam files and big spam sitemaps If you’re experiencing these

[ Read More ]

Fake DDoS Pages On WordPress Sites Lead to Drive-By-Downloads

It’s not uncommon for users to experience “DDoS Protection” pages when casually browsing the web. These DDoS protection pages are typically associated with browser checks performed by WAF/CDN services which verify if the site visitor is, in fact, a human or is part of a Distributed Denial of Service (DDoS) attack or other unwanted bot.

[ Read More ]