A single added line in WordPress’s query.php restores index.php and .htaccess from hidden backup files on every page load, undoing any cleanup.

A JavaScript injection waits for a logged-in WordPress administrator to visit the site, then uses their session to quietly create a new administrator account.

A JavaScript injected skimmer and its domain reveal an entire ASN of suspicious servers.

Strox offers more than just a phishing kit - it’s a vertical integration of the phishing process and consolidates all the different resources required for someone to begin phishing.

An injection into the wp-login.php file that secretly steals your WordPress login information.