Recently, one of my website has been hacked in a very interesting way.
By doing some researches I've found that I wasn't the only one affected by the hack, but didn't find anything about it.
Note : I am going to describe my website but after looking at other hacked websites, they all have the same behavior and look like the hack has been spreading.
Few information about the website :
- is using wordpress,
- is executed by apache
Information about the hack :
The website hasn't changed of any way. I still have my only page with a clean source code, which hasn't changed at all.
The way I've noticed that something was wrong on the site is that the title and description on Google suddenly became in Japanese, with some keywords like
Samsung ans other popular brands.
I then tried to domain search it on Google like
site:mywebsite.com. This gave me around 12k results (when there should be around 15 maximum), all being pages that redirect me to 404 with title and description in Japanese. All these pages have a cache version with different Japanese content.
When I try to look at the website "like Google" in the search console, I see the website being displayed like the cache version. There is some code in my website that targets Googles bot and create fake urls for it.
This looks like Pharma Hack, but the difference is that they are not trying to make any back-linking. There is absolutely no link that redirects to something else than my website (home or 404). Maybe it is more NSEO ?
I know that WordPress is one of the worse thing security-wise. But my question is more security oriented. Is this a known hack ? How does somebody target google's robot to make him see a totally different website that the one that I made ?