Recently, malware that alters the JAVASCRIPT file of WordPress and uses it as a parasite to display a fake login screen and steal login information has been spreading.


Fake login screen with parasitic WordPress JAVASCRIPT and header

This type of malware embeds malicious JAVASCRIPT code (a script language that runs in the browser) in the WordPress JQUERY or theme header and footer, and pulls images and CSS from various sites or official sites to display a fake login screen The fake login screen looks exactly the same as the real login screen.
As far as we have been able to ascertain, we have found scripts that produce login screens for Google, Microsoft, Facebook, and various banks. (However, we did not see any login screens for Japanese banks or services.)

If a user accidentally logs in from this screen, the login is not enabled, but the login information is sent to the hacker via email, compromising the user’s login information.

Phishing that displays a fake page

This type of malware that deceives by displaying fake pages to users is called phishing.
The malware itself is obfuscated as shown below so that it is not obvious at a glance how it works or where login information is sent.

What if I start seeing a fake login screen on my WordPress site?

Use the malware inspection plugin to inspect and remove malware.

Free] WordPress:Malware Scan & Security Plugin [Malware and Virus Detection and Removal].

Other security measures may also need to be taken, as there is a high possibility that some security hole exists in the site that allowed this malware to be embedded in the site.

Reference
Five WordPress security measures

In addition, it may be difficult to find and remove this malware with plug-ins alone, because the embedding location may be in a very deep hierarchy, or there may be another backdoor that generates this JAVASCRIPT.

In such cases, we recommend that you consult a specialist.

Related Posts:

  1. WordPress malware Redirect to fake login page
    Recently, there have been an increasing number of cases of malware that direct users to a new type of fake login page. We will explain this malware....
  2. What to do when a WordPress site displays a red screen saying “This site may cause damage to your computer.
    This section explains how site operators can deal with a red screen on a WordPress site that says “This site may cause damage to your computer....
  3. What is Japanese SEO Spam, a type of WordPress malware?
    We will explain about Japanese SEO Spam, which is a malware that embeds fake Japanese product sites in WordPress....
  4. WordPress malware Fake browser update page
    Recently there has been an increase in WordPress malware that displays a fake browser update page. We will explain this malware....
  5. How to Prevent WordPress Site-to-Site Malware Infection
    Taking advantage of the convenience of being able to operate multiple domain sites under a single server contract, malware today often analyzes the server folder structure and spreads infection from one site to the folders of other sites (domains)....
  6. If your wordpress index.php has a one line include statement @include it is infected with malware
    If there is a one-line include statement @include in the index.php in the top directory of WordPress or in the theme, etc., it is highly likely that the site is infected with malware....