The most common types of website malware

Backdoor: the hidden back door

A backdoor is a small script through which the attacker can return at any time, even if passwords have been changed. It likes to sit in upload folders, disguised as an image or cache file, or as injected code in a harmless-looking file.

Spam injection and keyword hack

Here the malicious code generates thousands of pages advertising medicines, gambling or counterfeit branded goods. A well-known variant is the Japanese keyword hack, in which pages with Japanese text get into the Google index. Visitors often see nothing of this, but search engines certainly do.

Redirects

Visitors are redirected to third-party sites, often only on the first visit, only from mobile devices or only when clicking from Google search. This makes this type hard to trace, because the operator usually sees nothing unusual when opening the site.

Skimming in the online shop

With shops, attackers target payment data. An injected script reads card details directly in the checkout and sends them to a third-party server. The shop continues to work normally, which is why the attack is often only noticed through customer complaints.

Other forms

• Cryptominers that secretly use the computing power of visitors or the server.
• Phishing pages placed in the web space that imitate third-party logins.
• Defacement, in which the home page is visibly replaced by a message from the attackers.
• Spam sending via manipulated forms or injected mail scripts.

How malicious code gets in

Most break-ins exploit known gaps in outdated extensions, weak or reused passwords or insecure settings. The OWASP Top 10 summarise the most common types of vulnerabilities in web applications.