There have been an increasing number of cases of web shells, a type of WordPress malware, becoming more sophisticated in recent years. We will explain about web shells.


What is a webshell?

A web shell is a malware that is, so to speak, a toolkit of tools that hackers can use to conduct unauthorized activities on a server.
Web shells are often stand-alone files with various functions packed into them.

Major functions that may be included in a web shell

Examine folder structure
Adding and deleting files
Change the write permissions of a file
Tamper with another file
Rewrite a database
Sending malformed e-mails
Embed arbitrary JAVASCRIPT code

etc.

How is the web shell embedded in wordpress?

60% of the reasons why WordPress is tampered with are vulnerabilities in old plugins or programs in WordPress itself. The other 20% or so will be a breach of the password for WordPress administrator privileges.

Hackers use hacking tools to try to exploit vulnerabilities in one WordPress site after another, and once they are in, they embed dangerous programs such as the web shell mentioned above into the site.

Reference
Percentage of WordPress sites that are hacked

What kind of program is Web Shell?

Most web shells have a process called obfuscation that prevents the contents of the program from being read.

*Examples of obfuscated malware

Unobfuscation Service
http://php-decoder.site

Web Shell Detection

Web shells are not always easy to find because they can be hidden in folders deep within WordPress or regulated in general files.
WordPress typically contains thousands of program files, which can be difficult to locate manually.

Free WordPress:Malware Scan & Security Plugin [Malware and Virus Detection and Removal].

If you have any malware, please use a malware scan plugin such as [Free] WordPress:Malware Scan & Security Plugin [Malware & Virus Detection and Removal].
Please try it.

Related Posts:

  1. What is Japanese SEO Spam, a type of WordPress malware?
    We will explain about Japanese SEO Spam, which is a malware that embeds fake Japanese product sites in WordPress....
  2. 5 characteristics of malware files that infect WordPress
    Here are some characteristics of malware files that can infect WordPress. If such a file is found on the server, it is most likely malware....
  3. Characteristics of malware code when WordPress is tampered with
    We will explain what kind of malware (programs that perform malicious behavior) can be embedded in a site when WordPress is defaced by hackers....
  4. File names commonly seen these days in WordPress malware
    Here are some common malware (virus) file names that WordPress Doctor has discovered recently....
  5. 10 files in which malformed JAVASCRIPT code is embedded when WordPress is tampered with.
    This section describes a file in which redirect hack code is often embedded, which causes a WordPress-created site to jump to another site when accessed (redirect)....
  6. WordPress malware Fake browser update page
    Recently there has been an increase in WordPress malware that displays a fake browser update page. We will explain this malware....