WordPress sites compromised by Password-cracking botnet

Denis Sinegubko, the cybersecurity researcher, has been keenly monitoring website hacking activities for quite some time, according to a report. He has recognized a shift from crypto wallet drainers to brute-force password-cracking attacks on WordPress sites. Why is this happening, what does it mean, and what can you, as an end user, do?

In February, Sinegubko in a blog discussed an increase in "web3 crypto malware," particularly malware used to inject crypto drainers into existing sites or use phishing sites for the same purpose.

The new attack methods function in a different way and utilize visitors' PCs for en masse password cracking attempts. This reason behind this is likely because it will take a very long time for the active "crypto drainers" to actually turn a profit, if they even manage to do so before getting blocked.

 As Sinegubko says, "This is how thousands of visitors across hundreds of different websites unknowingly and simultaneously try to bruteforce thousands of other third-party WordPress sites. And since the requests come from the browsers of real visitors, you can imagine this is a challenge to filter and block such requests."

Any infected WordPress site can have its visiting users (or their browsers) put to automated work on guessing author or admin passwords for other WordPress sites. Attackers are estimated to be guessing, with over 41,800 passwords for each impacted site. However, only one of the thousands of sites checked in the original Securi blog post was compromised with this method.

To avoid this, the users need to secure the passwords and if you don't trust the website you're visiting, NoScript can be an essential solution to prevent these types of exploits.  

For WordPress admins and those concerned about this, verify that none of your passwords, especially system-critical passwords, are default or lazily set in any way. Proper password practice and firewalling your WordPress admin page and "xmlrpc.php" file are the recommended solutions for WP site owners who want to get ahead of this.