# 安全研究

- [10,000 WordPress Websites Found Delivering MacOS and Windows Malware](https://cside.dev/blog/10-000-wordpress-websites-found-delivering-macos-and-microsoft-malware) - cside.dev, 2025
- [Client-Side Attack Report Q2 2025](https://cside.com/blog/client-side-attack-report-q2-2025) - cside.com, 2025
- [If you're using Polyfill.io code on your site – like 100,000+ are – remove it immediately](https://www.theregister.com/2024/06/25/polyfillio_china_crisis/) - theregister.com, 2024
- [Malicious Script Injection on WordPress Sites](https://blog.sucuri.net/2024/12/malicious-script-injection-on-wordpress-sites.html) - blog.sucuri.net, 2024
- [Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack](https://thehackernews.com/2024/06/over-110000-websites-affected-by.html) - thehackernews.com, 2024
- [Polyfill supply chain attack hits 100K+ sites](https://sansec.io/research/polyfill-supply-chain-attack) - sansec.io, 2024
- [Thousands of WordPress sites facing malware infection following major plugin hack](https://www.techradar.com/pro/security/thousands-of-wordpress-sites-facing-malware-infection-following-major-plugin-hack) - techradar.com, 2024
- [Embedded Secrets in Webpage DOMs](https://securityboulevard.com/2022/09/embedded-secrets-in-webpage-doms/) - securityboulevard.com, 2022
- [Crafty Web Skimming Domain Spoofs “https”](https://krebsonsecurity.com/2020/03/crafty-web-skimming-domain-spoofs-https/) - krebsonsecurity.com, 2020
- [A popular WordPress plugin leaked access tokens capable of hijacking Twitter accounts](https://techcrunch.com/2019/01/17/wordpress-plugin-leaked-twitter-account-access-tokens/) - techcrunch.com, 2019
- [Breaking news: Bank-card-slurping malware sneaks into Forbes' mag subscription website](https://www.theregister.co.uk/2019/05/16/forbes_magecart_infection/) - theregister.co.uk, 2019
- [Correos y otras 4.600 webs, infectadas para robar contraseñas y datos de pago](https://www.adslzone.net/2019/05/13/correos-picreel-cloud-cms-hack/) - adslzone.net, 2019
- [Criminelen onderscheppen wachtwoorden en betaaldata via 'formjacking'](https://tweakers.net/nieuws/152712/criminelen-onderscheppen-wachtwoorden-en-betaaldata-via-formjacking.html) - tweakers.net, 2019
- [DataSpii: The catastrophic data leak via browser extensions](https://securitywithsam.com/2019/07/dataspii-leak-via-browser-extensions/) - securitywithsam.com, 2019
- [Fake jquery campaign leads to malvertising and ad fraud schemes](https://blog.malwarebytes.com/threat-analysis/2019/06/fake-jquery-campaign-leads-to-malvertising-and-ad-fraud-schemes/) - blog.malwarebytes.com, 2019
- [Falha que deixa conta do Twitter vulnerável é encontrada em plugin do Wordpress](https://canaltech.com.br/seguranca/falha-que-deixa-conta-do-twitter-vulneravel-e-encontrada-em-plugin-do-wordpress-130977/) - canaltech.com.br, 2019
- [H steht für Hack: E-Commerce-Anbieter Volusion liefert Kreditkarten-Malware aus](https://www.heise.de/security/meldung/H-steht-fuer-Hack-E-Commerce-Anbieter-Volusion-liefert-Kreditkarten-Malware-aus-4551016.html) - heise.de, 2019
- [Hackers están recopilando contraseñas y datos de pago de 4.600 webs, incluida Correos](https://www.genbeta.com/actualidad/hackers-estan-recopilando-contrasenas-datos-pago-4-600-webs-incluida-correos) - genbeta.com, 2019
- [Infectan más de 4.000 webs para recopilar todo tipo de información, métodos de pago y contraseñas de los usuarios](https://www.redeszone.net/2019/05/13/paginas-web-infectadas-robar-informacion-contrasenas/) - redeszone.net, 2019
- [Les coordonnées de paiement de 5.000 sites piratées](https://www.futura-sciences.com/tech/actualites/securite-coordonnees-paiement-5000-sites-piratees-76063/) - futura-sciences.com, 2019
- [Tens of thousands of customers may have had their credit card information stolen](https://www.dailymail.co.uk/sciencetech/article-7552153/Thousands-customers-credit-card-data-stolen-hack-6-500-online-stores.html) - dailymail.co.uk, 2019
- [Card stealing malware hits +100 Aussie e-stores](https://www.itnews.com.au/news/card-stealing-malware-hits-100-aussie-e-stores-511807) - itnews.com.au, 2018
- [Card-stealing code that pwned British Airways, Ticketmaster pops up on more sites via hacked JS](https://www.theregister.co.uk/2018/09/12/feedify_magecart_javascript_library_hacked/) - theregister.co.uk, 2018
- [Clever SEO Spam Injection](https://blog.sucuri.net/2018/12/clever-seo-spam-injection.html) - blog.sucuri.net, 2018
- [Feedify becomes latest victim of the Magecart malware campaign](https://www.zdnet.com/article/feedify-becomes-latest-victim-of-the-magecart-malware-campaign/) - zdnet.com, 2018
- [Feedify-script voor webwinkels voorzien van creditcardskimmer](https://www.security.nl/posting/576929/Feedify-script+voor+webwinkels+voorzien+van+creditcardskimmer) - security.nl, 2018
- [Gehackte WordPress-sites gebruikt voor helpdeskfraude](https://www.security.nl/posting/578088/Gehackte+WordPress-sites+gebruikt+voor+helpdeskfraude) - security.nl, 2018
- [Hackers breach StatCounter to hijack Bitcoin transactions on Gate.io exchange](https://www.zdnet.com/article/hackers-breach-statcounter-to-hijack-bitcoin-transactions-on-gate-io-exchange/) - zdnet.com, 2018
- [Magento-webshops massaal gepakt door skimming-script](https://www.agconnect.nl/artikel/magento-webshops-massaal-gepakt-door-skimming-script) - agconnect.nl, 2018
- [Magento: Tausende Online-Shops von permanentem Bezahldatenklau betroffen](https://www.shopanbieter.de/13973-magento-tausende-online-shops-von-permanentem-kreditkartenklau-betroffen) - shopanbieter.de, 2018
- [MagentoCore Malware Found on 7,339 Magento Stores](https://www.bleepingcomputer.com/news/security/magentocore-malware-found-on-7-339-magento-stores/) - bleepingcomputer.com, 2018
- [MagentoCore Malware That Steals Payment Card Details While You Shop Online](https://gbhackers.com/magentocore-malware-steals-payment-card/) - gbhackers.com, 2018
- [MagentoCore Payment Card Data Stealer Uncovered on 7,339 Magento-based Websites](https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/magentocore-payment-card-data-stealer-uncovered-on-7339-magento-based-websites) - trendmicro.com, 2018
- [MagentoCore: il codice che ha infettato 7mila ecommerce e cattura i dati delle carte di credito](https://cybersecurity.startupitalia.eu/61640-20180907-magentocore-codice-infettato-7mila-ecommerce-cattura-dati-delle-carte-credito) - cybersecurity.startupitalia.eu, 2018
- `Massive localstorage[.]tk Drupal Infection` (https://blog.sucuri.net/2018/05/massive-localstorage-tk-drupal-infection.html) - blog.sucuri.net, 2018
- [Massive WordPress Redirect Campaign Targets Vulnerable tagDiv Themes and Ultimate Member Plugins](https://blog.sucuri.net/2018/08/massive-wordpress-redirect-campaign-targets-vulnerable-tagdiv-themes-and-ultimate-member-plugins.html) - blog.sucuri.net, 2018
- [More than 2,000 WordPress websites are infected with a keylogger](https://arstechnica.com/information-technology/2018/01/more-than-2000-wordpress-websites-are-infected-with-a-keylogger/) - arstechnica.com, 2018
- [Statcounter: Schadcode in Webseite hijackt Krypto-Börse](https://www.borncity.com/blog/2018/11/07/statcounter-schadcode-in-webseite-hijackt-krypto-brse/) - borncity.com, 2018
- [Vulnerabilitate: Mii de magazine online folosesc scriptul care a permis atacul informatic de la British Airways](https://www.startupcafe.ro/afaceri/vulnerabilitate-magazine-online-british-aiways-atac-informatic.htm) - startupcafe.ro, 2018
- [Who’s In Your Online Shopping Cart?](https://krebsonsecurity.com/2018/11/whos-in-your-online-shopping-cart/) - krebsonsecurity.com, 2018
- [WordPress redirection campaign uses .js file, fake plug-ins to send victims to scam sites](https://www.scmagazine.com/wordpress-redirection-campaign-uses-js-file-fake-plug-ins-to-send-victims-to-scam-sites/article/789809/) - scmagazine.com, 2018
- `Cloudflare[.]Solutions Keylogger on Thousands of Infected WordPress Sites` (https://blog.sucuri.net/2017/12/cloudflare-solutions-keylogger-on-thousands-of-infected-wordpress-sites.html) - blog.sucuri.net, 2017
- [Keylogger Found on Nearly 5,500 Infected WordPress Sites](https://www.bleepingcomputer.com/news/security/keylogger-found-on-nearly-5-500-infected-wordpress-sites/) - bleepingcomputer.com, 2017
- [Keylogger Found On Nearly 5,500 WordPress Sites](https://yro.slashdot.org/story/17/12/07/1317249/keylogger-found-on-nearly-5500-wordpress-sites) - yro.slashdot.org, 2017
- [Thousands of WordPress sites infected with a Keylogger and cryptocurrency miner scripts](http://securityaffairs.co/wordpress/66432/hacking/keylogger.html) - securityaffairs.co, 2017
- [キーロガー＆マイニング用スクリプト入りのマルウェアがWordPressで流行中、5500近いサイトに感染](https://gigazine.net/news/20171208-wordpress-keylogger/) - gigazine.net, 2017

Source: https://hk.publicwww.com/docs/use-cases/security/