Security News > 2022 > March > Hundreds of GoDaddy-hosted sites backdoored in a single day
Internet security analysts have spotted a spike in backdoor infections on WordPress websites hosted on GoDaddy's Managed WordPress service, all featuring an identical backdoor payload. The case affects internet service resellers such as MediaTemple, tsoHost, 123Reg, Domain Factory, Heart Internet, and Host Europe Managed WordPress.
The discovery comes from Wordfence, whose team first observed the malicious activity on March 11, 2022, with 298 websites infected by the backdoor within 24 hours, 281 of which were hosted on GoDaddy.
The backdoor infecting all sites is a 2015 Google search SEO-poisoning tool implanted on the wp-config.
Bleeping Computer has contacted GoDaddy to find out more about this possibility, but we have not heard back yet.
Notably, GoDaddy disclosed a data breach in November 2021 that affected 1.2 million customers and multiple Managed WordPress service resellers, including the six mentioned in the introduction.
In any case, if your website is hosted on GoDaddy's Managed WordPress platform, make sure to scan your wp-config.