WordPress sites served as launching pad for Flashback

Share this article:

The malware responsible for infecting more than 650,000 Mac computers worldwide can thank compromised WordPress sites for its spread, experts say.

The Flashback trojan, first discovered in February, infiltrated Mac OS X platforms through a now-patched Java vulnerability, giving attackers the ability to perform a number of mischievous actions, including stealing data, installing additional malware and intercepting search engine traffic.

To spread the malware, its authors relied on infecting WordPress sites so that when unsuspecting users visited, they were silently redirected to a site that installed Flashback, a tactic known as a drive-by download, Alexander Gostev, head of Kaspersky Lab's global research and analysis team, said Thursday in a blog post.

From February to March, thousands of sites created on the popular publishing platform were poisoned, Gostev said. Researchers believe the sites' webmasters were running vulnerable versions of WordPress.

“Websense put the number of affected sites at 30,000, while other companies say the figure could be as high as 100,000,” Gostev wrote. “Approximately 85 percent of the compromised WordPress sites are located in the United States.”

In late January, Websense began tracking the outbreak on WordPress, one of several that have appeared in recent months and years.

The Kaspersky analysis states that contrary to popular belief, the invulnerability of the Mac OS X is a myth. It is, in fact, no safer than any other operating system. The size of the botnet has dramatically decreased in April as a number of patches released by Apple have cooled the activity.

Although the main infection vectors are the hacked sites, user oversight is ultimately to blame, said Roel Schouwenberg, senior researcher for Kaspersky Lab, in an email to SCMagazine.com on Thursday.

“WordPress is a very popular platform for attackers to target,” he said. “There's not a whole lot WordPress can do if people neglect to update their WordPress or plug-in software.”

It's unclear what the Flashback botnet is being used for. Currently, researchers have not received reports signaling fraudulent activity, Shouwenberg said.

Representatives from Apple and WordPress could not be reached for comment.

Share this article:

Sign up to our newsletters

More in News

Incapsula mitigates multi-vector DDoS attack lasting longer than a month

Incapsula mitigates multi-vector DDoS attack lasting longer than ...

Incapsula's scrubbing servers were able to filter out more than 50 petabits of malicious DDoS traffic aimed at a video game company for longer than a month.

UPS announces breach impacting 51 U.S. locations

The shipping and printing provider said malware has been present on some stores' computer systems since mid-January.

'Machete' espionage campaign targets orgs in Venezuela, Ecuador

The campaign targets Spanish speaking victims, which also appears to be the native language of attackers.