0

This question already has an answer here:

A friend of mine asked me to upgrade his Wordpress instance to PHP 7.2. When I wanted to login on wp-admin to verify his plugins, I got redirected to http://leftoutsidemyprofile.info/up.js

I then noticed that this URL has also been inserted into the HTML and CSS files of the instance.

I haven't found anything on google except for other Wordpress instances which contain that link. archive.org knows this URL since the end of April.
I tried to de-obfuscate the contents of this Javascript file (https://pastebin.com/WBpXpvvb) but I can't really make sense of it.

What's also strange: I tried to send that URL to my friend via Facebook Messenger to ask him if he knew anything about it and the message got blocked.

Is this a new hack?

Update: I also found the domain hellofromhony, and this is available in Google.

With this new domain that I found throughout the investigation (hellofromhony) I was able to gather some information about the attack:

Basically, an attacker could get WP admin rights and change the siteurl and home url, redirecting all requests for images, js and css files to the attackers servers.

marked as duplicate by schroeder May 3 at 10:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • So, what's your question? This is obviously a hack. What do you want to know? – schroeder May 3 at 10:48
  • Obviously how to remove it. Usually, I am able to solve issues like that with the help of google, but because I found nothing about that domain, I was having some problems. Now I have found another domain - see question update - so I was able to get some information. – Daniel Hilgarth May 3 at 10:51
  • So your question is how to remove it? That is not clear at all in your question. You do not "remove" it. You rebuild the server. – schroeder May 3 at 10:52
  • Sorry for my sloppy terminology. From what I understand from the information regarding the other domain, the issue is with security issues with some plugins. Also, this question hopefully serves as a stop for other google searchers. – Daniel Hilgarth May 3 at 11:09
  • Please re-open, I am currently drafting an answer with extended information to what the exploit was – Daniel Hilgarth May 3 at 11:10
2

Yes, this is obviously a hack.

  • Unknown code inserted
  • obfuscated code
  • the domain was registered on April 26
  • chat filters blocking the domain

Not the answer you're looking for? Browse other questions tagged or ask your own question.