Search Results for 'malware'

Hello tagDiv Team and Community,

I wanted to report a severe, obfuscated malware infection targeting the Newspaper theme ecosystem that I recently diagnosed and cleaned. The malware specifically targets mobile users while executing stealth tactics to hide from logged-in administrators.

Here are the technical details of the exploit to help the security team and other users:

1. The Behavior:
Mobile visitors loading the site are immediately hit with a 302 Redirect chain. The network analysis showed the site calling a rogue script masquerading as an ad network: [https://async.gsyndication.com/](https://async.gsyndication.com/). This script then loads a Yandex tracking tag ([https://mc.yandex.ru/metrika/tag.js](https://mc.yandex.ru/metrika/tag.js)), which triggers the final destination spam redirect (e.g., varors.com).

2. The Entry Point / Core Infection:
The script dynamically prepends an obfuscated PHP code block to the very top of wp-config.php using an eval(base64_decode(…)) string. When decoded, the script explicitly avoids injecting the malicious payload if the request URI contains paths like /wp-admin/, /wp-json, or wp-login.php, effectively hiding the redirect from site admins.

3. The Active Backdoor Location:
After cleaning wp-config.php, the file was repeatedly re-infected. Running a server-side file modification search (find . -mtime -2 -type f) isolated the live backdoor execution directly inside the td-mobile-plugin directory.

Files inside wp-content/plugins/td-mobile-plugin/ (specifically Mobile_Detect.php and custom code panel handlers) had been compromised and modified by the attacker to act as a persistent script injector. Every time a mobile user-agent touched the site, the plugin dynamically rewrote wp-config.php to maintain persistence.

How it was resolved:

Completely deleted the compromised td-mobile-plugin directory from the server.

Cleaned the wp-config.php file and stripped the eval block.

Implemented define( ‘DISALLOW_FILE_MODS’, true ); and hardened server file permissions (chmod 440 on config).

Please look into how the automated bots are injecting code into the td-mobile-plugin directories, and let this serve as a warning to other webmasters to check their mobile plugin files if they experience ghost redirects!

My website, news360.info, is currently experiencing significant speed issues. After upgrading to a new server, I carried out a full malware scan and removed detected threats, which initially improved performance. However, the site has since become slow again despite further optimisation efforts on my end.

I would appreciate your expert review and guidance to help identify and resolve the underlying problem.

Thank you for your continued support.

My service provider has notified me that I have these vulnerabilities on my site.

Could you provide an update?
Thank you.

wp-content/plugins/td-composer/legacy/common/common.php {HEX}Malware.Expert.php.base64.decode.UNOFFICIAL

wp-content/plugins/js_composer/assets/lib/vendor/node_modules/bootstrap3/dist/js/bootstrap.min.js SecuriteInfo.com.End-Of-Life-found-in-Bootstrap.UNOFFICIAL

These codes are coming from the /td-composer/legacy/common/common.php

common.php php.base64.decode
common.php php.base64.decode
common.php php.base64.decode

My host is reporting that there is malware on my site at public_html/wp-content/plugins/td-composer/legacy/common/common.php, and the malware is php.base64.decode

I have looked at the code in a fresh download of td_composer and it has the following:
/**
* return the decoded demo file settings
*/
add_filter( ‘td_demo_installer’, function( $file_path ) {
//read the settings file
return unserialize(base64_decode(file_get_contents($file_path, true)));
});

function tdc_b64_decode( $val ) {
return base64_decode( $val );
}

function tdc_b64_encode( $val ) {
return base64_encode( $val );
}

In it. Is this problematic, can I remove it ?

Subject: URGENT: Security Breach on Website Using Newspaper Theme – Russian Betting Spam & Login Issues
Dear tagDiv Support Team,

I am reaching out regarding a critical and ongoing security issue affecting our WordPress website, which uses the Newspaper theme (version 12.7.1) purchased from ThemeForest.

🔐 Problem Description:
Our website — https://nishaanebaz.com/ — is under constant attack, with the following issues occurring:

Unauthorized posting of Russian betting content, likely injected by a bot or script.

Inability to log in to the WordPress admin dashboard, which may indicate privilege escalation or account hijacking.

These incidents have been happening every day since last week, severely affecting site integrity and user trust.

🖥️ Website and Hosting Details:
Website URL: https://nishaanebaz.com/

WordPress Version: 6.8.1

Newspaper Theme Version: 12.7.1

Hosting Provider: Hostinger

First Incident Date: Daily since approximately June 10, 2025

⚙️ Actions We’ve Taken:
Activated maintenance mode to limit further spam posting.

Reset admin password via phpMyAdmin.

Scanned files and database for known malware or spam injection.

Identified and removed unauthorized posts and suspicious users.

🚨 Request for Assistance:
We urgently request your support to:

Investigate any known vulnerabilities or exploitation paths in version 12.7.1 of the Newspaper theme.

Provide guidance, patches, or recommended security settings to harden the theme.

Confirm whether this issue has affected other customers or is specific to our setup.

Share any security best practices or plugin recommendations to prevent recurrence.

As a publicly accessible news platform, this is significantly impacting our publication’s reputation and operation.

We are happy to provide logs, access details, or screenshots upon request. Please treat this as a priority issue.

Hi, my website has been hacked, I’ve noticed this morning that one of my pages has a redirection to some strange website (or 502 bad gateway, as per Safari error message). I’ve read on another request that there was a vulnerability issue on Newspaper V12.7 and the last update V12.7.1 has fixed it. I didn’t have installed the last update yet, so I assume the malware could have come from that vulnerability.
My questions are :
– Do you recommend to clean it first or to update Newspaper to V12.7.1 ?
– To remove the malware, do you have any info that could help ?
– When such vulnerability is suspected, why don’t you send an emailing to all your contacts that bought your template to tell them to update quickly to the new version ?
Thank you.
Emma

Hi,

I’ve been using the Newsmag theme on my website, agakhanism.com, and it has recently been compromised with malware. My security advisor has informed me that the theme contain vulnerabilities, even though I’m using the most updated version available.

I’m very concerned about the risk of my website being hijacked due to this issue. It’s disappointing that a theme with such a high number of sales is not being properly maintained from a security standpoint.

Please look into this matter urgently. I need a solution as soon as possible to secure my website and prevent further issues.

Thank you.

Warning: Vulnerable tagDiv Theme Newsmag theme found at ./wp-content/themes/Newsmag/includes/tagdiv-config.php – Version: 5.4.3.3 – Please update this theme or switch it immediately: https://wpscan.com/vulnerability/038327d0-568f-4011-9b7e-3da39e8b6aea.
——————————–

Out of date software is the most common cause of website compromise. It’s highly recommended to get that updated as soon as you can.