#yara

A #Wordpress site belonging to an friend (I’m not the admin...) was successfully hacked using #wp2shell (17.07.2026; #CVE-2026-63030), just 5 days after the first exploit published (20.07.). Another 5 days later, the website was abused for SEO spamming and for hosting phishing… If you haven't already, update your Wordpress (preferably yesterday…) and also enable automatic updates for themes and plug-ins! I found several PHP backdoors/webshells (see @abuse_ch@ioc.exchange Malware Bazaar and #VirusTotal (hashes below)). Interestingly, not every sample was detected by the #YARA rules from @cyb3rops@infosec.exchange and https://github.com/ruppde/yara_rules tl;dr #wp2shell is being actively exploited, patch immediately and enable automatic updates. Hashes: 1093b4045b45a8498d146e31788c25769f992056c8ffc582b5d8c06598598966 05e3884a478d3bc8fd7285dabb74107422f1615d2d7f80df9b8438d4beb663da bb9136494a546368e7c9b6252c2e1c5af9327c07947908a9ba6fdd78fb4bf4cf 1e7ca9074cc2eca8d366022629f665d9ffaa79e0621bb579bf5aabe681cb07e8 8ebaf3ba0be7b62269aaf333cfaf66c1dea6e8ee495a917691beb550b4bbf0ab e3fb920aa70c7ad5c67b4d9b8e60954f5e0c1a07c0eba09505816b966f4d1a3c 165e94c87ef17389c8de25ba2a6c31b348e3c916dab89d0dd3708156414f3de5 b55cf5af8b57e9d56c69d00e023e2384c7eb184614c2a2a283062ebeaf4a26c6 a46230a1638b9b341d15a640ead1b885548c1d1e5a149657e8e315540a068be8 7918f29993383e579ef33bd0d8e766fd2ce047dce83bac51efb5fe17578b6cdf ae9ee9db7c41e04c531298782b908766c769a899aa92df3f64f4a83baa77ad09

#ThreatIntel #YARA #SupplyChainAttack rule ADFORM_TRACKPOINT_CLIPPER_2026 { meta: description = "Clipboard hijacker appended to Adform trackpoint-async.js" author = "Raze Security" date = "2026-07-28" reference = "s2.adform.net/banners/scripts/st/trackpoint-async.js" tlp = "CLEAR" strings: $key = /0x4d\s*,\s*0x33\s*,\s*0x77\s*,\s*0x54\s*,\s*0x77\s*,\s*0x30/ nocase $f1 = "_hookValue" ascii $f2 = "_scanInputs" ascii $f3 = "_scanText" ascii $c2 = "84.32.102.230:7744" ascii $path = "/p?h=" ascii $btc = "bc1qmplgt0hcg62jc2guz86wn2sms7tqrsulkkrrls" ascii $eth = "0xE7983E69df17079ADb0aD7b3458488Cac0dBc573" ascii nocase $re = "[1-9A-HJ-NP-Za-km-z]{33}" ascii $clip = "navigator.clipboard.readText" ascii condition: $c2 or $btc or $eth or ($key and 1 of ($f*)) or (2 of ($f*) and $clip and $re) or ($c2 and $path) }