Balada Injector

Balada Injector is a malicious software known for stealing information from wp-config.php files, primarily targeting WordPress websites. Active since 2017, this malware has been notorious for exploiting vulnerabilities in various WordPress themes and plugins to infiltrate systems. A significant wave of Balada Injector attacks occurred in September 2023, where more than 17,000 WordPress websites were compromised, effectively doubling the number of infections compared to the previous month. The malware injects scripts into the code of public WordPress pages, often tricking site admins into further infecting their own sites. The first wave of these attacks, known as the "Newspaper theme-related Balada Injector waves," planted harmful scripts into public WordPress pages through a domain named stay.decentralappps[.]com. Additionally, on December 13th, Sucuri reported that the Balada Injector campaign began infecting websites using older versions of the Popup Builder (CVE-2023-6000), with a CVSS score of 8.8. This vulnerability led to over 7,100 WordPress sites getting infected with the Balada Injector malware. Mitigation steps have been suggested for those who suspect their website may be infected with Balada Injector malware or believe they have unwanted script injections in WordPress. Known Balada Injector server IPs have been identified, which can be used in tracking and blocking the source of these attacks. Despite these measures, Balada Injector continues to infect thousands of WordPress sites, demonstrating its persistent threat to web security.