Hi, my website is hacked by an unknown person called as Greeceman. Many other users has also faced same issue in last 2 months, you can read the reditt thread here: https://www.reddit.com/r/Wordpress/comments/16nlg60/wpzexit/?rdt=43651
Same issue is with my website, whenever someone visit my website on phone, in one sessions the user will be redirected to an unknown ad source. I have initially deleted the user account he has made suspicially and also deleted 2 plugins he has installed. I have added fresh copy of newspaper theme but still the website is redirecting to that unknown link. Can anybody from your team can help me resolve this issue.
My website address is https://careersquare.in/
Hello,
Please let me know what theme version you have.
Please update the theme to the latest version 12.6.2.
This malware infects not only theme files but also WordPress files or other plugin files. This malware was not detected only in our theme but also in many other themes and plugins https://www.bleepingcomputer.com/news/security/massive-balada-injector-campaign-attacking-wordpress-sites-since-2017 / -> https://cybernews.com/security/wordpress-malware-epidemic-balada-injector/ -> https://www.geoedge.com/balda-injectors-2-0-evading-detection-gaining-persistence /
You could consider reinstalling the WordPress version, reinstalling the theme, and checking for this plugin wp-zexit.php. It might be wise to inspect via FTP if it doesn’t appear in the WordPress -> Plugins. Additionally, using Wordfence to scan the website and remove unknown users would be prudent.
Thank you!
Hi,
I’m glad that is resolved.
Have a great day!
