Fake Antivirus Exploit Found On Many WordPress Sites

This site like a multitude of others is run off WordPress. There has been a piece of malware detected that masquerades as antivirus software. This has been found on 200,000+ web pages, which is almost 30,000 unique sites according to Websense. The exploit, which mostly affects sites built with WordPress, places a short piece of injected code at the bottom of a page:

What commonly happens when a person loads the page, they’re redirected to a page in the .rr.nu top-level domain that mimics a Windows security scan, then asks them to download a malicious program to supposedly clear viruses from their computer. It’s a common scam that’s been running in various forms for years, and Websense has been tracking this particular threat for several months.

Although the source of the malware is unknown, over 85 percent of the affected sites are from the United States, and it has been traced in many cases to old WordPress installs. Those who runs WordPress software, it’s something to watch out for.