4,300+ com­pro­mised Word­Press blogs poi­son

A Russ­ian researcher named Sinegubko iden­ti­fied 4,358 Word­Press blogs that com­bined pop­u­lar images from other sites with so-called door­way pages that redi­rected vis­i­tors to a series of mali­cious sites.

He fur­ther wrote. “How­ever the mali­cious redi­rects occur only when you click on Google Images search results, which proves that Google Images poi­son­ing is the main goal of this black-hat SEO campaign.”

This is a major prob­lem for sites using Word­press and par­tic­u­larly for themes with embed­ded pop­u­lar Word­Press exten­sion known as TimThumb.

So web­mas­ters are advised to update their self-hosted word­press instal­la­tion and pos­si­bly look for weird codes on .htac­cess file.

You may con­tact directly the researcher Sinegubko here. Just in case you have some infor­ma­tion on this problem.