For five years, at least 1 million WordPress sites have been attacked.
CTOnews.com Internet security firm Sucuri reported that it has uncovered activity affecting at least 1 million WordPress sites dating back to 2017, which security experts have named Balad Injector.
CTOnews.com learned from the Sucuri report that the Balada Injector attack wave occurs about once a month, and each attack uses a newly registered domain name to escape the block list.
The campaign is primarily aimed at redirecting users to fake tech support pages, fraudulent lottery wins, and push notification scams.
Balada's script focuses on stealing sensitive information such as database credentials from the wp-config.php file, so attackers retain their access even if the website owner cleans up the infection and patches their add-ons.
