Compromised Word Press Blogs: A Phisher's Paradise
Summary: Cisco Talos reports that over 5 percent of the phishing and malicious emails it collected over roughly a month contained links with WordPress-related URLs, using compromised blogs as staging points for Blackhole and other exploit kits. A Verizon Wireless monthly statement phish pointed to a /wp-content/uploads/fgallery/vz.html URL that the sandbox confirmed as Blackhole, prompting new rule SID 23171 alongside the earlier SID 21941 for PHP files in the Fgallery directory.
Why it matters: A Google query for "wordpress file upload vulnerability" returns 459,000 results, with live exploits on the first several pages, so an unpatched WordPress install is a ready-made entry point for anyone running a phishing campaign.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026