{"id":4612,"date":"2015-06-09T17:22:57","date_gmt":"2015-06-09T21:22:57","guid":{"rendered":"http:\/\/acro.net\/blog\/?p=4612"},"modified":"2015-06-09T17:24:23","modified_gmt":"2015-06-09T21:24:23","slug":"sweet-captcha-wordpress-plugin-spread-ads-serving-malware","status":"publish","type":"post","link":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/","title":{"rendered":"Sweet Captcha : WordPress plugin spread ads serving malware"},"content":{"rendered":"<p>A year ago I raved over the <a href=\"http:\/\/acro.net\/blog\/domains\/sweet-captcha-solve-this-little-puzzle-spambot\/\" target=\"_blank\"><strong>discovery of Sweet Captcha<\/strong><\/a>, a free captcha plugin for WordPress.<\/p>\n<p>At the time, and until yesterday, the plugin appeared to do its task quietly, blocking thousands of spam comments on my blog publications.<\/p>\n<p>Unfortunately, since at least Sunday, Sweet Captcha has been quietly serving pop-ups and pop-unders to visitors that click on links. The majority of these ads came from <a href=\"https:\/\/whois.domaintools.com\/mediaupdate15.com\" target=\"_blank\"><strong>mediaupdate15.com<\/strong><\/a>, serving rogue malware, ransomware and other content.<\/p>\n<p>I spent two days wondering whether my work station is infected, and ran extensive tests only to discover that<strong> all issues disappeared<\/strong> once Sweet Captcha was disabled, removed and <strong>deleted<\/strong> from the WordPress blogs.<\/p>\n<p>In a cunning manner, the ads would set a cookie with a lifespan of several minutes, so that subsequent visits would not display ads immediately. That kept me from identifying the issue at first.<\/p>\n<p>The Sweet Captcha incident is described in detail at the <a href=\"https:\/\/blog.sucuri.net\/2015\/06\/sweetcaptcha-service-used-to-distribute-adware.html\" target=\"_blank\"><strong>Sucuri blog<\/strong><\/a>, and the WordPress plugin has been <strong>removed<\/strong> from the WordPress.org repository. You can view a <strong><a href=\"http:\/\/webcache.googleusercontent.com\/search?q=cache:https:\/\/wordpress.org\/plugins\/sweetcaptcha-revolutionary-free-captcha-service\/\" target=\"_blank\">cached page here.<\/a><\/strong><\/p>\n<p>I hope the removal is permanent.<\/p>\n<p>With the proliferation of WordPress as a publishing medium, one has to be very skeptical and careful about the use of plugins that can open a window to digital maladies. <strong>I no longer trust nor do I recommend Sweet Captcha;<\/strong> once the trust is gone, it&#8217;s gone for good.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A year ago I raved over the discovery of Sweet Captcha, a free captcha plugin for WordPress. At the time, and until yesterday, the plugin appeared to do its task quietly, blocking thousands of spam comments on my blog publications. Unfortunately, since at least Sunday, Sweet Captcha has been quietly serving pop-ups and pop-unders to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[1155,1156,1043,1157,1158],"class_list":["post-4612","post","type-post","status-publish","format-standard","hentry","category-domains","tag-malware","tag-pop-ups","tag-sweet-captcha","tag-sweet-captcha-plugin","tag-wordpress-org","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Sweet Captcha : WordPress plugin spread ads serving malware<\/title>\n<meta name=\"description\" content=\"Sweet Captcha : WordPress plugin spread ads serving malware\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Sweet Captcha : WordPress plugin spread ads serving malware\" \/>\n<meta property=\"og:description\" content=\"Sweet Captcha : WordPress plugin spread ads serving malware\" \/>\n<meta property=\"og:url\" content=\"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"Acro.net - A Domain Investing Blog by Theo Develegas\" \/>\n<meta property=\"article:published_time\" content=\"2015-06-09T21:22:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2015-06-09T21:24:23+00:00\" \/>\n<meta name=\"author\" content=\"Theo Develegas\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Theo Develegas\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\\\/\"},\"author\":{\"name\":\"Theo Develegas\",\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/#\\\/schema\\\/person\\\/9c9625f061a0e603a87f5bf0f6f781fe\"},\"headline\":\"Sweet Captcha : WordPress plugin spread ads serving malware\",\"datePublished\":\"2015-06-09T21:22:57+00:00\",\"dateModified\":\"2015-06-09T21:24:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\\\/\"},\"wordCount\":239,\"commentCount\":3,\"keywords\":[\"malware\",\"pop-ups\",\"Sweet Captcha\",\"Sweet Captcha plugin\",\"WordPress.org\"],\"articleSection\":[\"Domains\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/acro.net\\\/blog\\\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\\\/\",\"url\":\"https:\\\/\\\/acro.net\\\/blog\\\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\\\/\",\"name\":\"Sweet Captcha : WordPress plugin spread ads serving malware\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/#website\"},\"datePublished\":\"2015-06-09T21:22:57+00:00\",\"dateModified\":\"2015-06-09T21:24:23+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/#\\\/schema\\\/person\\\/9c9625f061a0e603a87f5bf0f6f781fe\"},\"description\":\"Sweet Captcha : WordPress plugin spread ads serving malware\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/acro.net\\\/blog\\\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/acro.net\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Sweet Captcha : WordPress plugin spread ads serving malware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/acro.net\\\/blog\\\/\",\"name\":\"Acro.net - A Domain Investing Blog by Theo Develegas\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/acro.net\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/acro.net\\\/blog\\\/#\\\/schema\\\/person\\\/9c9625f061a0e603a87f5bf0f6f781fe\",\"name\":\"Theo Develegas\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6794630c371bee89f2b833c1f4b777d9ba75767b217c8fce2cfd6e6d7d90960d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6794630c371bee89f2b833c1f4b777d9ba75767b217c8fce2cfd6e6d7d90960d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6794630c371bee89f2b833c1f4b777d9ba75767b217c8fce2cfd6e6d7d90960d?s=96&d=mm&r=g\",\"caption\":\"Theo Develegas\"},\"description\":\"Theo Develegas - News and opinions on domain name investing, brand development, design, and the occasional rant or two about life's challenges. Founder of Acroplex LLC.\",\"sameAs\":[\"https:\\\/\\\/acro.net\",\"https:\\\/\\\/x.com\\\/acroplex\"],\"url\":\"https:\\\/\\\/acro.net\\\/blog\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Sweet Captcha : WordPress plugin spread ads serving malware","description":"Sweet Captcha : WordPress plugin spread ads serving malware","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/","og_locale":"en_US","og_type":"article","og_title":"Sweet Captcha : WordPress plugin spread ads serving malware","og_description":"Sweet Captcha : WordPress plugin spread ads serving malware","og_url":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/","og_site_name":"Acro.net - A Domain Investing Blog by Theo Develegas","article_published_time":"2015-06-09T21:22:57+00:00","article_modified_time":"2015-06-09T21:24:23+00:00","author":"Theo Develegas","twitter_misc":{"Written by":"Theo Develegas","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/#article","isPartOf":{"@id":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/"},"author":{"name":"Theo Develegas","@id":"https:\/\/acro.net\/blog\/#\/schema\/person\/9c9625f061a0e603a87f5bf0f6f781fe"},"headline":"Sweet Captcha : WordPress plugin spread ads serving malware","datePublished":"2015-06-09T21:22:57+00:00","dateModified":"2015-06-09T21:24:23+00:00","mainEntityOfPage":{"@id":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/"},"wordCount":239,"commentCount":3,"keywords":["malware","pop-ups","Sweet Captcha","Sweet Captcha plugin","WordPress.org"],"articleSection":["Domains"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/","url":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/","name":"Sweet Captcha : WordPress plugin spread ads serving malware","isPartOf":{"@id":"https:\/\/acro.net\/blog\/#website"},"datePublished":"2015-06-09T21:22:57+00:00","dateModified":"2015-06-09T21:24:23+00:00","author":{"@id":"https:\/\/acro.net\/blog\/#\/schema\/person\/9c9625f061a0e603a87f5bf0f6f781fe"},"description":"Sweet Captcha : WordPress plugin spread ads serving malware","breadcrumb":{"@id":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/acro.net\/blog\/sweet-captcha-wordpress-plugin-spread-ads-serving-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/acro.net\/blog\/"},{"@type":"ListItem","position":2,"name":"Sweet Captcha : WordPress plugin spread ads serving malware"}]},{"@type":"WebSite","@id":"https:\/\/acro.net\/blog\/#website","url":"https:\/\/acro.net\/blog\/","name":"Acro.net - A Domain Investing Blog by Theo Develegas","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/acro.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/acro.net\/blog\/#\/schema\/person\/9c9625f061a0e603a87f5bf0f6f781fe","name":"Theo Develegas","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/6794630c371bee89f2b833c1f4b777d9ba75767b217c8fce2cfd6e6d7d90960d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6794630c371bee89f2b833c1f4b777d9ba75767b217c8fce2cfd6e6d7d90960d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6794630c371bee89f2b833c1f4b777d9ba75767b217c8fce2cfd6e6d7d90960d?s=96&d=mm&r=g","caption":"Theo Develegas"},"description":"Theo Develegas - News and opinions on domain name investing, brand development, design, and the occasional rant or two about life's challenges. Founder of Acroplex LLC.","sameAs":["https:\/\/acro.net","https:\/\/x.com\/acroplex"],"url":"https:\/\/acro.net\/blog\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/acro.net\/blog\/wp-json\/wp\/v2\/posts\/4612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/acro.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/acro.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/acro.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/acro.net\/blog\/wp-json\/wp\/v2\/comments?post=4612"}],"version-history":[{"count":0,"href":"https:\/\/acro.net\/blog\/wp-json\/wp\/v2\/posts\/4612\/revisions"}],"wp:attachment":[{"href":"https:\/\/acro.net\/blog\/wp-json\/wp\/v2\/media?parent=4612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/acro.net\/blog\/wp-json\/wp\/v2\/categories?post=4612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/acro.net\/blog\/wp-json\/wp\/v2\/tags?post=4612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}