Of Phishing Attacks and WordPress 0days

This post details the analysis and neutralization of a phishing campaign that utilized compromised WordPress sites and a zero-day vulnerability. It describes the phishing email's structure, the compromised landing pages hosted on Bluehost, and the various URL obfuscation techniques employed by attackers (image maps, misspelled domains, homoglyphs, reflection, redirection, javascript, Punycode). The post also highlights the discovery of a critical cross-site scripting vulnerability in WordPress 4.1.1, which was likely exploited in the attack. Cloudflare's collaboration with Bluehost in responding to compromised sites is also mentioned.