News for hackers. Stuff that matters.

A comment on Wordpress.com – Russian malware hidden in home folder.

Re:Wordpress.com – Russian malware hidden in home folder by wyhycu on Tuesday October 17, 2023 @04:21PM (#37921014)
In case anyone else is struggling with random Russian casino posts appearing in your wordpress.com website, I found the culprit.

The instance has 2 folders. htdocs & a read-only wordpress folder with sample content with I cannot alter.

The text in the sample matches the spam posts. "./themes/organic-stax/1.4.6.1/demo/default-demo-content.xml: <content:encoded><![CDATA[Имеется множество формальностей, которые приходиться придер..." (see pastebin link for more)

I have shared this with wordpress support and they stopped replying to my emails. Now I have to check and delete any new posts every day.

Will update if wordpress.com finally addresses this.

[ Parent | on HN ]
Re:Wordpress.com – Russian malware hidden in home folder by stefanos82 on Tuesday October 17, 2023 @04:41PM (#37921293)
I have tried to find this content and could not for some reason.

Can you please try with `curl` command to produce the pastebin output so we can test it from our side?

UPDATE: Never mind, I have found it!

[ Parent | on HN ]
Re:Wordpress.com – Russian malware hidden in home folder by wyhycu on Wednesday October 18, 2023 @03:40PM (#37933718)
Update: wordpress.com has removed/replaced the file, it appears. Support case still unaddressed but root problem is solved. No more mystery posts.
[ Parent | on HN ]