The blogging platform WordPress has been under attack the past three weeks with VisitorTracker malware code, a campaign that started slowly but has been gaining in intensity, according to Sucuri blog.
At first, the malware would simply edit the headers and footers of a site, affixing javascript that would redirect visitors to a Nuclear Exploit Kit landing page. From there it would attempt to infiltrate victims' computers via a browser vulnerability and open it to zero-days that could initiate the siphoning of data.
But then, as the Sucuri researchers explained, the code evolved to include "multiple layers of encodings and the end result was this piece of code injected to every javascript file on the site."
The team advised WordPress users to keep plugins and software updated, disable Java and Flash, and regularly run anti-virus programs.
