Real infections.
Documented cleanups.

Three unknown domains were showing a food company’s site with rewritten links: a Cloudflare Worker was cloning it in real time. Blocked the same…

A member finds spam pages on Google and a warning under the association’s name. Domain and access recovered, site cleaned within 24 hours.

A company changes hosting to leave its problems behind, but copies the site as is: backdoors, users and payloads move along. Cleaned within 12…

Customers hit by phishing that used the real data from their orders, with clean files: a webhook and an API key created by a…

Forced Remote Desktop access, Defender exclusions, a miner, and a skimmer in the checkout: WooCommerce cleaned within 12 hours, then migrated from Windows to…

Offensive banners and rewritten headlines at night, no malware: the revisions led to the account of a former contributor who was still an Editor.…

A neglected plugin, a webshell and a local privilege escalation never patched on CentOS 7: the server was root-compromised. WordPress cleaned within 12 hours,…

A skimmer on the WooCommerce checkout came back every night after cleanup: a hidden cron job and a PHP process resident in memory. Site…

Redirects to fake lotteries visible only on mobile and from Google: SQL triggers that reinfected posts and a payload in wp_options. Cleaned within 12…

Google Safe Browsing red warning: a phishing kit in uploads, a hidden fake plugin and obfuscated files. Site cleaned within 24 hours and review…