Over 5,000 WordPress Sites Infected with Keylogger

Security researchers observed that more than 5,000 WordPress sites were infected by a malware tracked as “Cloudeflare.solutions,” which initially performed cryptomining and has been updated to include a keylogger. The malware injects code into themes' functions.php, uses counterfeit Cloudflare-like domains to deliver payloads, aims to harvest login credentials and target e-commerce platforms for banking fraud, and defenders are advised to remove the malicious add_js_scripts function and related add_action clauses.