Thousands of WordPress websites, utilizing an insecure version of the Popup Builder plugin, have fallen victim to a malware named Balada Injector. Discovered by Doctor Web in January 2023, the attack operates through periodic waves exploiting vulnerabilities in WordPress plugins. These attacks insert backdoors designed to redirect visitors to deceptive tech support pages, fake lottery winnings, and push notification scams. Sucuri's subsequent investigations revealed the extensive nature of the operation, active since 2017 and infiltrating over 1 million sites. Identified on December 13, 2023, Sucuri detected Balada Injector activities on more than 7,100 sites, leveraging a high-severity flaw (CVE-2023-6000, CVSS score: 8.8) in Popup Builder, a plugin with 200,000+ active installs. WPScan disclosed the vulnerability a day earlier, and the issue was addressed in version 4.2.3.

When successfully exploited, the vulnerability allows attackers to perform actions within the target site that the logged-in administrator can do, including installing arbitrary plugins and creating rogue Administrator users, as highlighted by WPScan researcher Marc Montpas. The campaign's ultimate aim is to implant a malicious JavaScript file hosted on specialcraftbox[.]com, enabling control of the website for malicious redirects. Balada Injector's operators establish persistent control by uploading backdoors, adding malicious plugins, and creating rogue blog administrators. JavaScript injections specifically target logged-in site administrators, utilizing their browser cookies to emulate administrator activity.

Sucuri researcher Denis Sinegubko noted that when blog administrators log in, their browser contains cookies allowing administrative tasks without repeated authentication. The new Balada Injector wave, detected if logged-in admin cookies are present, exploits elevated privileges to install a rogue backdoor plugin ("wp-felody.php" or "Wp Felody"). This facilitates fetching a second-stage payload from the specified domain, saved as "sasas" in the temporary files directory, executed, and subsequently deleted. The payload scans directories up to three levels above the current one, modifying the wp-blog-header.php file in detected site root directories to inject the same Balada JavaScript malware as initially inserted via the Popup Builder vulnerability.

Source: https://thehackernews.com/2024/01/balada-injector-infects-over-7100.html