Malwarebytes: PHP exploits, Brotli flaw and compromised certificates cluster with ClickFix on hacked WordPress sites
Malwarebytes describes an unusual cluster of web security problems in one week: attackers exploiting two PHP flaws, a critical flaw in Brotli software used by Node.js, and eight compromised security certificates. It also notes that criminals hacked legitimate WordPress sites to serve fake verification pages in ClickFix attacks that trick visitors into running commands and installing malware. The article is mainly consumer safety guidance and gives no CVE IDs, IOCs or technical specifics for these issues. Most browsers have blocked the certificates, though other software and devices may still need updates.
Detalhes técnicos
- PHP is used by about 7 in 10 websites with a known server-side language; Node.js by 7.4% of websites with an identified web-server technology (W3Techs).
- ClickFix lures disguise malicious commands (e.g. PowerShell) as routine verification or troubleshooting steps, delivered through compromised legitimate WordPress sites.
- HTTPS protects the connection only and does not indicate a page is safe.
Remediação
- Enable automatic updates for the OS, browser and applications.
- Keep browser phishing and malware protection enabled, such as Malwarebytes Browser Guard.
- Use unique passwords in a password manager and enable multifactor authentication.
- Never run commands or install software prompted by a website; verify update or account requests through official settings, apps or support channels.
- Use real-time anti-malware protection.
Linha do tempo
-
Malwarebytes: PHP exploits, Brotli flaw and compromised certificates cluster with ClickFix on hacked WordPress sites
ler a análise desta fonte ocultar
Malwarebytes describes an unusual cluster of web security problems in one week: attackers exploiting two PHP flaws, a critical flaw in Brotli software used by Node.js, and eight compromised security certificates. It also notes that criminals hacked legitimate WordPress sites to serve fake verification pages in ClickFix attacks that trick visitors into running commands and installing malware. The article is mainly consumer safety guidance and gives no CVE IDs, IOCs or technical specifics for these issues. Most browsers have blocked the certificates, though other software and devices may still need updates.
Technical Details
- PHP is used by about 7 in 10 websites with a known server-side language; Node.js by 7.4% of websites with an identified web-server technology (W3Techs).
- ClickFix lures disguise malicious commands (e.g. PowerShell) as routine verification or troubleshooting steps, delivered through compromised legitimate WordPress sites.
- HTTPS protects the connection only and does not indicate a page is safe.
Remediation
- Enable automatic updates for the OS, browser and applications.
- Keep browser phishing and malware protection enabled, such as Malwarebytes Browser Guard.
- Use unique passwords in a password manager and enable multifactor authentication.
- Never run commands or install software prompted by a website; verify update or account requests through official settings, apps or support channels.
- Use real-time anti-malware protection.