WordPress New Security Threat: Hackers Infecting WordPress Sites With Coinhive Miner Script.

As cryptocurrency and blockchain technology is evolving and gaining more fame, everyone has started focusing on the crypto game. Lately, I have been reading about how video streaming and torrent websites using some kind of script to mine cryptocurrencies as monetization.But I never though hackers could also use it by putting the script on other's website and earn money until I got to see it myself.

Yesterday I found out that one of my WordPress websites was hacked as Kaspersky Antivirus denied to open my in any browser saying it contained some kind of serious malware threat.

Below was the screenshot of Kaspersky Alert Message on browsers.

I wasn't familiar with this error since this has happened first time with me. Then I tried running Sucuri Website scanner and it detected some threats as malware.cryptominer.1 as in image.

Sucuri detected plenty of pages with malware.cryptominer.1. I didn't have any idea about this malware since I didn't hear about it before. So looked up Sucuri's malware DB and learned that it's a same old WordPress brute force attacks with new variations.

As per Sacuri's Description:

Website contains a script that among other things injects a Coinhive JavaScript miner into browsers of the site visitors.
The script is typically injected into the footer section of web pages. It hides from search engine bots and changes frequently. The main decoded part looks like a fake base64-encoded image

---

As WordPress is the most popular CMS and blogging platform, it is always the number one target for hackers.But now they are taking it to a new level with the growing blockchain technology and cryptocurrency. And a new platform called Coinhive comes to be a mighty angel for them.If you don't know yet, Cognitive is a platform which offers a JavaScript miner for the Monero cryptocurrency that anyone can embed in his website and to mine Monero from visitor's CPU power.And hacker's are using the same javascript miner from Coinhive to mine cryptocurrency for them.

What they do here is they hack the website(in my case WordPress) and insert the miner code from coinhive somewhere inside your core files to mine crypto for them. Running some further scans I noticed suspecious codes inside Jeckpack Plugin. I was using pretty much older version of jetpack and updating this solved the problem for me right now but I am not sure whether it's permanet.

---

PS: At least keep your Wordpre,Themes and Plugin Up to Date.

---

---

Posted on Utopian.io - Rewarding Open Source Contributors

---