Evasive Sign1 malware campaign infects 39,000 WordPress sites

**Sign1 malware campaign:** Sucuri observed a WordPress-focused malware campaign that has infected over 39,000 sites in six months by injecting obfuscated JavaScript (via custom HTML widgets or the Simple Custom CSS and JS plugin) that uses time-based dynamic domains, XOR encoding, referrer/cookie checks, and hosting/domain-hopping to redirect visitors to scam captchas and push-notification ad fraud.