FlagThis - #wordpress

Hackers have successfully compromised the popular WordPress plugin Gravity Forms, embedding malicious code into versions downloaded directly from the official gravityforms.com website. This sophisticated supply chain attack targets a significant portion of WordPress websites relying on Gravity Forms for form creation and data collection. The attackers are reportedly exploiting a vulnerability within the plugin, specifically targeting the gf_api_token parameter. This allows them to inject malicious PHP code into core plugin files, such as gravityforms/common.php and includes/settings/class-settings.php, creating backdoors that can lead to remote code execution and unauthorized access.

The malicious campaign was first detected when security researchers observed suspicious HTTP POST requests to a newly registered domain, gravityapi.org, which served as a command-and-control server. The injected malware is capable of exfiltrating sensitive WordPress site data, including URLs, plugin lists, user counts, and environment details, transmitting this information to the attacker-controlled domain. Upon receiving a response, the malware can deploy further payloads, such as writing a backdoored PHP file to the server that masquerades as legitimate content management tools. This backdoor enables attackers to execute arbitrary code, create new administrator accounts, upload files, and manipulate site content with devastating effects.

In response to the discovered vulnerability, Gravity Forms has swiftly released version 2.9.13 of the plugin, which is confirmed to be free of the backdoor. Additionally, the registrar Namecheap has suspended the malicious gravityapi.org domain to disrupt ongoing exploitation efforts. Website administrators are strongly advised to update their Gravity Forms plugin to the latest version immediately to mitigate the risk of compromise. Monitoring network traffic for suspicious activity, particularly POST requests to the identified malicious domain, is also a crucial step in preventing unauthorized access and code execution on affected WordPress sites.


References :

• cyberpress.org: WordPress GravityForms Plugin Targeted in Malicious Code Injection Attack
• Ian Campbell: Just a heads-up on this supply chain attack on the Gravity Forms wordpress plugin, one IOC is POST requests to gravityapi[.]org - a 3 day old domain. That domain shares an IP with gravityapi[.]io. cc
• Talkback Resources: WordPress Gravity Forms developer hacked to push backdoored plugins
• gbhackers.com: Hackers Compromise WordPress GravityForms Plugin with Malicious Code Injection
• Cyber Security News: WordPress GravityForms Plugin Targeted in Malicious Code Injection Attack
• securityonline.info: WordPress Supply Chain Attack: Gravity Forms Plugin Backdoored Through Official Downloads
• gbhackers.com: Hackers have targeted the popular WordPress plugin Gravity Forms, injecting malicious code into versions downloaded from the official gravityforms.com domain.

Classification:

• HashTags: #WordPress #SupplyChainAttack #Malware
• Company: Microsoft
• Target: WordPress sites
• Product: Gravity Forms
• Feature: Code Injection
• Type: Malware
• Severity: Major

A sophisticated cybercriminal network known as VexTrio has been exploiting WordPress sites to run a global scam network. Cybersecurity researchers have uncovered a large-scale campaign involving malicious JavaScript injections into legitimate websites. These injections redirect visitors to various scam pages through traffic broker networks associated with VexTrio, a major cybercriminal affiliate network. The network uses sophisticated DNS techniques, traffic distribution systems (TDS), and domain generation algorithms to deliver malware and scams across global networks, impacting thousands of websites globally.

VexTrio operates through a network of malicious adtech companies, including Los Pollos, Taco Loco, and Adtrafico, which function as commercial affiliate networks. These networks connect malware distributors with "advertising affiliates" who promote illicit schemes such as gift card fraud, malicious apps, phishing sites, and scams. The compromised WordPress sites are injected with malicious code, initiating a redirection chain to VexTrio's scam infrastructure. Examples of such malicious injections include Balada, DollyWay, Sign1, and DNS TXT record campaigns.

The campaign has seen significant activity, with over 269,000 websites infected with JSFireTruck JavaScript malware in a single month. This obfuscation technique uses only six ASCII characters to produce working code, making it difficult to analyze without specialized tools. The injected code checks for search engine referrers and redirects users to malicious URLs delivering malware, exploits, and malvertising. While efforts to disrupt the network, such as the exposure of Los Pollos' involvement, have caused temporary disruptions and shifts in tactics, the VexTrio network continues to pose a substantial threat.


References :

• blogs.infoblox.com: Vexing and Vicious: The Eerie Relationship between WordPress Hackers and an Adtech Cabal
• The Hacker News: WordPress Sites Turned Weapon: How VexTrio and Affiliates Run a Global Scam Network
• The Hacker News: Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month
• unit42.paloaltonetworks.com: Palo Alto Networks researchers Hardik Shah, Brad Duncan & Pranay Kumar Chhaparwal discovered a large-scale campaign that has been compromising legitimate websites with injected, obfuscated JavaScript code.
• www.scworld.com: 270K websites injected with ‘JSF-ck’ obfuscated code
• Infoblox Blog: Vexing and Vicious: The Eerie Relationship between WordPress Hackers and an Adtech Cabal
• ciso2ciso.com: Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month – Source:thehackernews.com
• Techzine Global: DNS analysis reveals links between VexTrio and WordPress hackers
• Virus Bulletin: Palo Alto Networks researchers Hardik Shah, Brad Duncan & Pranay Kumar Chhaparwal discovered a large-scale campaign that has been compromising legitimate websites with injected, obfuscated JavaScript code.
• ciso2ciso.com: WordPress Sites Turned Weapon: How VexTrio and Affiliates Run a Global Scam Network – Source:thehackernews.com
• ciso2ciso.com: WordPress Sites Turned Weapon: How VexTrio and Affiliates Run a Global Scam Network – Source:thehackernews.com

Classification:

• HashTags: #VexTrio #WordPress #Malware
• Company: WordPress
• Target: WordPress website owners and users
• Attacker: VexTrio
• Product: WordPress
• Feature: Malware Distribution
• Malware: Viper TDS
• Type: Malware
• Severity: Major

A large-scale malware campaign, dubbed JSFireTruck, has infected over 269,000 legitimate websites by injecting malicious JavaScript code. Researchers at Palo Alto Networks Unit 42 discovered the campaign, noting the injected code utilizes JSF*ck, an obfuscation technique making detection difficult. This method leverages only six ASCII characters to create working JavaScript, obscuring the code's true purpose and hindering analysis. The obfuscated code primarily consists of the symbols [, ], +, $, {, and }, further complicating identification.

The injected JavaScript code checks the website referrer, and if a user arrives from a search engine like Google, Bing, DuckDuckGo, Yahoo!, or AOL, the code redirects them to malicious URLs. These URLs can lead to malware downloads, exploits, traffic monetization schemes, and malvertising. Unit 42's telemetry detected 269,552 web pages infected with JSFireTruck code between March 26 and April 25, 2025, highlighting the widespread impact and rapid proliferation of this campaign. A spike in the campaign was first recorded on April 12, when over 50,000 infected web pages were observed in a single day.

The campaign's scale and stealth pose a significant threat, indicating a coordinated effort to compromise legitimate websites and use them as attack vectors for further malicious activities. The use of JSF*ck further complicates analysis, requiring specialized tools for deobfuscation. Palo Alto Networks customers are better protected from the threats discussed in this article through the following products and services:Advanced WildFire, Advanced URL Filtering and Advanced DNS Security.


References :

• Unit 42: JSFireTruck: Exploring Malicious JavaScript Using JSF*ck as an Obfuscation Technique
• Virus Bulletin: Palo Alto Networks researchers Hardik Shah, Brad Duncan & Pranay Kumar Chhaparwal discovered a large-scale campaign that has been compromising legitimate websites with injected, obfuscated JavaScript code.
• The Hacker News: Over 269,000 Websites Infected with JSFireTruck JavaScript Malware in One Month
• www.scworld.com: 270K websites injected with ‘JSF-ck’ obfuscated code

Classification:

• HashTags: #JSFireTruck #JavaScript #Malware
• Company: Palo Alto Networks
• Target: Website Users
• Attacker: JSFireTruck Operators
• Feature: JSF*ck Obfuscation
• Malware: JSFireTruck
• Type: Malware
• Severity: Major