Guys Please Be Aware

[ThisIsMyLife]

Of Nulled WordPress stuff. Recently, my web server got hit so hard by SEO malware creating posts and altering WordPress core files. This malware spouts from a nulled plugin I downloaded a couple of months ago.
It began with inserting an EVAL function in the header of all PHP files in any directory it could possibly find. Including your core WordPress files. This function is one of the worst ever existed in PHP which is eval you can read on it and its vast capabilities.
The nomenclature of this malware is Ion Cube malware. The worst part of this malware is how it can masquerade you by creating WordPress-alike files one of the most famous examples can be:
wp-feed.php
wp-tmp.php
WordPress doesn't have these files in their core files. So if you are not a rookie and strong observer you will be easily get tricked by. So again take all the precautions, as currently am struggling to backup 20+ websites.
Good Luck

 

[Alex D.]

Interesting, I learned it hard way no matter which nulled theme you download there must be something hidden in it. So, always be careful.

 

[Veil123]

The same happened to one of my sites a while ago, but for me wasn't a nulled theme/plugin but actually a plugin that was removed from the wordpress directory because of not being updated regularly and it probably had some huge loophole. In addition to what @ThisIsMyLife said, always take care and check the plugins/themes at least once per week too.

 

[ss_social]

Crap! That's terrible! I hope you can recover your websites soon and thanks for the information!

 

[MidtownMan]

Good catch, I always look at wordpress nulled themes.. But these kind of stories have always steered me away. Hopefully you get everything straightened out buddy.

 

[wisdomkid]

Of Nulled WordPress stuff. Recently, my web server got hit so hard by SEO malware creating posts and altering WordPress core files. This malware spouts from a nulled plugin I downloaded a couple of months ago.
It began with inserting an EVAL function in the header of all PHP files in any directory it could possibly find. Including your core WordPress files. This function is one of the worst ever existed in PHP which is eval you can read on it and its vast capabilities.
The nomenclature of this malware is Ion Cube malware. The worst part of this malware is how it can masquerade you by creating WordPress-alike files one of the most famous examples can be:
wp-feed.php
wp-tmp.php
WordPress doesn't have these files in their core files. So if you are not a rookie and strong observer you will be easily get tricked by. So again take all the precautions, as currently am struggling to backup 20+ websites.
Good Luck

It's never free. No matter how hard the giver try telling you.

 

[ThisIsMyLife]

It's never free. No matter how hard the giver try telling you.

Yes, I always believe in "Hard Work Must Pay-off"

 

[3bisu]

It reminds me of a recent issue about a gdpr plugin (updated) where hackers exploited some loophole and infected a lot of sites

 

[kurosaki4d]

Thank you @ThisIsMyLife for sharing your experience with us. It's sure will be valuable to all the members passing through here!

That been said, i've used in the past many nulled themes, i never had any problems with them, i was aware of the risks, but i guess i was lucky, but i no longer use them, since someone i know used a cracked theme that eventualy caught the attention of the hosting provider and they contacted him to tell him that his website containted code source sending a tremendous amount of requests in a short time non stop and they cleaned the folder for him!

So i guess yeah, i have to agree with the other members aswell, it's never free, there is always some hidden agenda there. Either they are doing some black hard SEO, or mining or collecting your data, etc...

But i'm curious though, there are some plugins that scan the theme or folder for you, didn't they work for you? (we would like to know if they are truely effective)

All that said, i realy hope you recover from this. We live and we learn buddy Tell us if we can be of any help to you !

 

[whiteblackseo]

Happened to me last year, WORST POSSIBLE EXPERIENCE EVER. Had to shell out almost $1000 just paying Wordfence to clean all my sites and then I had to buy the themes for each site. On top of that I found out a few months later that Wordfence was just ripping me off and it costed a fraction of that to clean the sites but it was too late.

If you guys need to clean your site I recommend Upwork. You can find good people to get the job done for a fraction than what the "big sites" charge.

 

[MidtownMan]

Happened to me last year, WORST POSSIBLE EXPERIENCE EVER. Had to shell out almost $1000 just paying Wordfence to clean all my sites and then I had to buy the themes for each site. On top of that I found out a few months later that Wordfence was just ripping me off and it costed a fraction of that to clean the sites but it was too late.

Wow, that sucks man.

Always back up everything, moral of the story.

 

[loving doll]

Of Nulled WordPress stuff. Recently, my web server got hit so hard by SEO malware creating posts and altering WordPress core files. This malware spouts from a nulled plugin I downloaded a couple of months ago.
It began with inserting an EVAL function in the header of all PHP files in any directory it could possibly find. Including your core WordPress files. This function is one of the worst ever existed in PHP which is eval you can read on it and its vast capabilities.
The nomenclature of this malware is Ion Cube malware. The worst part of this malware is how it can masquerade you by creating WordPress-alike files one of the most famous examples can be:
wp-feed.php
wp-tmp.php
WordPress doesn't have these files in their core files. So if you are not a rookie and strong observer you will be easily get tricked by. So again take all the precautions, as currently am struggling to backup 20+ websites.
Good Luck

these days in wordpress many kind of injections begin ,so i recommend wordfancy security or server site some malware detector otherwise google send malware related plenty ,i recently got for my domain and i saw some chaseback files are situated in wp-includes/js

 

[DunDidIt2X]

All that nulled and cracked stuff has malware .Its their business. Thats how they make their money .

 

[pm me cheese]

is there anything to stop this? what are you looking for in the source code?

 

[DunDidIt2X]

is there anything to stop this? what are you looking for in the source code?

Yeah just pay for the legit copy .

 

[JLee411]

Wp stuff is not that expensive and most of the time there is no need for a ton of plugins.
Just buy a legit copy.
On the other note, always install wp firewall or something similar.

 

[pm me cheese]

Yeah just pay for the legit copy .

$150 for the theme no thanks

i looked through the code before installing and it looked ok, site works fine, but if you know anything particular to look out for it would be helpful to post

 

[DunDidIt2X]

$150 for the theme no thanks

i looked through the code before installing and it looked ok, site works fine, but if you know anything particular to look out for it would be helpful to post

Usually they inject a backdoor script. Usually files will appear normal by name, but when you open it it will appear like a lot of gibberish. Eval, base 64 code

They spread it around all over sometimes in legit files in middle of legit code .if you dont know what you're looking for easy to not know if its legit or not. Mostly its about knowing what are legit files for the theme and WordPress. Thing is almost every nulled theme will have an edited/compromised wp core.

It will often cost more to save your site than just using a legit theme from the start .

 

[ThisIsMyLife]

Usually they inject a backdoor script. Usually files will appear normal by name, but when you open it it will appear like a lot of gibberish. Eval, base 64 code

They spread it around all over sometimes in legit files in middle of legit code .if you dont know what you're looking for easy to not know if its legit or not. Mostly its about knowing what are legit files for the theme and WordPress. Thing is almost every nulled theme will have an edited/compromised wp core.

It will often cost more to save your site than just using a legit theme.

It only injects in header not in the body or Footer of any PHP file. And since PHP is procedural It will execute the malicious code first and foremost

 

[Deleted member 813988]

Don’t steal, buy