In the wee morning hours another malicious piece of code found its way into several of my websites’ index.php file. This comes after being hacked once before due to a vulnerability in the PHPMyAdmin Worpdress plugin.

As luck would have it most of these injected iframe hacks tend to cause errors when displayed in the browser and I usually check my sites at least once a day either manually or through automated processes. So when I went to visit one of the sites that had been hacked I got a malware alert (I use Chrome). Of course I investigated the issue and found some base64 encoded php in my root index.php file:

eval(base64_decode(‘ZXJyb3JfcmVwb3……..));

This is just a sample of what was in the file. I ran the code through a base64 decode and basically the code was an iframe to a malicious site which is why I got the malware alert.