Nearly 2000 WordPress Websites Infected with a Keylogger

Over 2,000 WordPress websites have been found infected with a piece of Crypto-mining malware. The malware does not only steal the resources of visitors’ computers to mind digital currencies, but also logs visitors’ every keystroke. Researchers have discovered a malicious campaign that infects WordPress websites with a malicious script that delivers an in-browser cryptocurrency miner from Coinhive and a keylogger.

Coinhive is a popular browser-based service that offers website owners to embed JavaScript to utilize CPUs power of their website visitors in an effort to mine the Monero cryptocurrency. Researchers also stated that the actors behind this new campaign are the same ones who infected more than 5,000 WordPress websites last month. They identified this since both campaigns used keylogger/cryptocurrency malware called cloudfire[.]solutions.

Cloudfire[.]solutions is a cryptocurrency mining malware and is not related to network management and cybersecurity firm Cloudflare. Since the malware used cloudfire[.]solutions domain to spread the malware, it has been given this name.

https://thehackernews.com/2018/01/wordpress-keylogger.html