Evolution of the "Work from Home" Scam

The report documents a widespread scam campaign where attackers inject unique PHP pages into compromised WordPress sites (commonly under /wp-includes/ or /images/) to redirect victims to fake “work from home” newspaper-style landing pages; the scam uses geo-localization and spoofed site elements to appear legitimate, and thousands of sites have been affected with mixed Google Safe Browsing detection.