A hacker outfit calling itself WP-VCD has become a prevalent source of malware infections by exploiting a basic human weakness – our love of free stuff.
Suppose I want to use a professional version of a theme, but I’d rather not pay for it. I google the theme name along with “free download”, and I easily find sites promising the full professional version for free. The sites assure me that the theme is not nulled or pirated. One or more of these sites might be very high in the search results, giving me confidence it must be a legit site.
If I give into the temptation to download and install, saving myself a few bucks, I am effectively installing malware on my own site. No firewall or strong password can protect me from my weakness for free stuff.
The Wordfence blog has a post with more information, WP-VCD: The Malware You Installed On Your Own Site, as well as a whitepaper with detailed information.
