Takeaways
Seasoned cybercriminals hack legitimate websites as a way of setting phishing traps. Both long-neglected and actively maintained websites may be targeted this way. In particular, hackers tend to compromise smaller websites whose owners cannot immediately recognize their presence.
Websites powered by WordPress often suffer from vulnerabilities that allow scammers to easily gain access to the control panel using a special script and publish malicious content. Alternatively, hackers can brute-force the administrator’s credentials or use a stolen password. Website admins should use strong, unique passwords and multi-factor authentication to protect their accounts from hijacking, update the server software on a regular basis, and deactivate plugins that are not in use.
Signs of phishing on a hacked website
-
The page URL contains folders like /wp-Config/, /wp-content/, /wp-admin/, /wp-includes/ or similar, and the destination directory contains a PHP file. Web pages with the extension .php may be seen on legitimate websites, but they are a sure sign of phishing when combined with the above directory names.
-
The URL contains the correct (or modified) name of the service the scammers are trying to imitate, but the name has nothing to do with the name of the website itself.
-
The content on the home page is apparently unrelated to the phishing page.
If you’re lucky, you can dig around in the directory the phishing page is in, and find the other parts of the phish kit - usually just a php/html page, plus some image and css assets. sometimes it gets uploaded as a zip file which you can download to view the source of the page, which can be useful to see where harvested credentials are sent to. Most of the time they’re emailed off to a burner email, but sometimes they’re saved as a text file or posted to a secondary site.
I built up quite a large collection of phish kits while working at a CERT in the past, was cool to see how simple they were.