Balada Injector: Synopsis of a Massive Ongoing WordPress Malware Campaign

Our team at Sucuri has been tracking a massive WordPress infection campaign since 2017 — but up until recently never bothered to give it a proper name. Typically, we refer to it as an ongoing long lasting massive WordPress infection campaign that leverages all known and recently discovered theme and plugin vulnerabilities. Other organizations and blogs have described it in a similar manner, sometimes adding terms like “malvertising campaign” or naming domains that it was currently used (which amounts to …

balada injector black hat tactics blogs campaign domains hacked websites infection injector malvertising malvertising campaign malware malware campaign name obfuscation organizations plugin redirects sucuri synopsis team terms theme tracking vulnerabilities website malware infections website security wordpress wordpress plugins and themes wordpress security