Fallout in wordpress, Aug 31 – Sep 6

What we caught this week while monitoring over 163,052,840 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.

SUNDAY

Sun Sep 6 · 1 catch · 0 waves · 1 single
well-known/libwell-knownmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/packagewell-known/toolsmicro-behaviors/dataobjectivesobjectives/impactmicro-behaviors/ui+6 18d
Ajaxify Comments – …azy Loading Comments 3.2.2 wordpress wp-ajaxify-comments 208,405 installs 18 days ago

Russian propaganda audio injection

manipulation/browser

SATURDAY

Sat Sep 5 · 1 catch · 0 waves · 1 single
well-known/Mcmicro-behaviors/communicationsmicro-behaviorsmetadatametadata/langobjectives/anti-analysisobjectives/command-and-controlobjectivesobjectives/impactwell-knownmicro-behaviors/ui+8 19d
Passwords Manager 1.5.3 wordpress passwords-manager 7,608 installs 19 days ago

Malicious SweetAlert2 payload

manipulation/browsersupply-chain/sweetalert2-protestware

FRIDAY

Fri Sep 4 · 1 catch · 0 waves · 1 single
micro-behaviors/processmicro-behaviorsmalwaremalware/Mcmetadatametadata/packageobjectives/anti-staticobjectives/executionobjectivesobjectives/command-and-controlthird_party+6 19d
CMS ADMINS Security Check Report 2.2.2 wordpress security-check-report 88 installs 19 days ago

config.php contains webshell eval

webshell/decoderPHP/Gzinflated

TUESDAY

Tue Sep 1 · 3 catches · 0 waves · 3 singles
objectivesobjectives/anti-staticwell-knownwell-known/appmicro-behaviors/communicationsmicro-behaviorswell-known/libmicro-behaviors/datamicro-behaviors/fsmicro-behaviors/osthird_party+6 23d
Nexura Security — Malware… WordPress Security 1.0.13 wordpress nexura-security 674 installs 23 days ago

Embedded webshell signature payload

Encoded/PayloadsGeneric/Callback
micro-behaviors/communicationsmicro-behaviorsmicro-behaviors/cryptomicro-behaviors/datamicro-behaviors/fsmicro-behaviors/osmicro-behaviors/processmicro-behaviors/timemetadatathird_party 23d
RS Remote Site Manager 3.4.1 wordpress rootscope-remote-site-manager 1,933 installs 23 days ago

Backdoor activation detection logic

Generic/Callback
well-known/Mcmicro-behaviors/datamicro-behaviorsmetadatametadata/langwell-known/libmicro-behaviors/communicationsobjectivesobjectives/impactwell-knownmicro-behaviors/ui+6 23d
Passwords Manager 1.5.2 wordpress passwords-manager 7,545 installs 23 days ago

Malicious code in SweetAlert2 library

manipulation/browsersupply-chain/sweetalert2-protestware
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories