Amongst the PHP malwares targeting WP plugins’ vulnerabilities I encounter, some generate hundred of thousand of empty files with 0KB size in all folders and sub-folders recursively . which create diversion and affects the inodes capacity of an account. But diversion may not the only goal. as they are generated through an obfuscated code, so I can imagine that these filenames may be part of an obfuscation process. Instead of writing the directives directly in a PHP or text file, the information is gathered through the listing and ordering of the filenames, possible no? Or maybe I’m over-complicating it.
Continue reading