HoeflerText Malware Infection Via Google Chrome Browser + Spora Ransomware

  • Hi All, Like many of you poor souls out there, one of my WordPress sites was compromised yesterday with the HoeflerText-Google Chrome, Spora Ransomware Infection.
    I also repair virus infested computers as part of my small business, so this gave me a slightly different view of the problem.
    After seeing the screenshots of the infection, My hackles were raised over the “Font” replacement side of the infection, and the fact that it only seems to affect Google Chrome Browsers and not Firefox or any other browser.
    I Immediately suspected the Google Fonts Plug-in on the affected site, disabled it, and the HoeflerText issue was gone like a shot.
    I’m unsure of the exact plug-in that caused the issue, as i noticed that I had two different versions installed, from many changes that have been done to the site over the years.
    The Plug-In’s were:
    WP Google Fonts Version v3.1.4 | By Noah Kagan
    Google Fonts For WordPress Version 3.0.0 | By KAPlugins
    As i stated, i’m not sure which of them was the culprit, but disabling them both, immediately removed the HoeflerText problem.

    Over to the rest of you Sherlock’s to suss it out!

    Cheers,
    Dw

    • This topic was modified 8 years, 1 month ago by bluesdigital.
Viewing 2 replies - 1 through 2 (of 2 total)
  • Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri, SiteLock and Wordfence are a few.

    If you think this is related to a vuln in a specific plugin, please email plugins (at) wordpress (dot) org

    Thread Starter bluesdigital

    (@bluesdigital)

    Hi Steve, Yep, have checked the site with sitecheck.sucuri etc, and it all comes up roses.
    I’m pretty damn sure its one of those plugs, shall email my notes onwards.
    Many thanks for the useful links ??

    Cheers

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘HoeflerText Malware Infection Via Google Chrome Browser + Spora Ransomware’ is closed to new replies.