WordPress Redirect Malware Exploits Google Tag Manager, Leading to Spam Domains

• What happened: Attackers exploit Google Tag Manager in WordPress websites to redirect users to malicious domains.
• Why it matters: Malicious code injects hijacked website traffic, leading to domains often containing spam.
• Overall impact: This kind of malicious GTM code injection impacts website credibility and exposes visitors to scams.

A new wave of WordPress redirect malware has been detected, exploiting Google Tag Manager (GTM) scripts to inject malicious code and hijack website traffic. This sophisticated attack compromises WordPress databases, redirecting users to spam domains and damaging website credibility.  

The Attack Method  

Cybercriminals are injecting malicious GTM scripts directly into WordPress databases, bypassing traditional file-based malware scanners, according to the latest Sucuri report.

These scripts call remote JavaScript code hosted on Google Tag Manager’s domain, loading redirects to spam websites. 

The malware leverages GTM’s trusted reputation to evade detection, embedding itself in database tables like wp_options and wp_posts.  

One campaign uncovered by cybersecurity experts involved a GTM container ID (GTM-PL2J2GLH) being used across over 200 WordPress sites. The scripts redirect visitors to spam domains such as spelletjes[.]nl, harming user experience and reputation. 

The attackers likely gained admin-level access through compromised credentials, adding the destructive scripts via the WordPress admin panel.  

Impact on WordPress Sites  

This Google Tag Manager exploit disrupts website functionality, leading to adverse SEO consequences and reduced visitor trust. 

Redirects from infected websites often result in malware warnings from browsers and security tools, potentially blacklisting the site. Businesses face significant operational and reputational risks alongside possible financial losses.  

Remediation Steps  

Website owners can mitigate this WordPress security threat using these remediation measures:

• Audit GTM Scripts.
• Database Cleanup
• Update Security Layers 
• Harden Admin Access.  
• Perform Malware Scans

A similar attack occurred earlier this month, involving malicious code injections into WordPress themes that redirected users to other websites. Malicious Google Tag Manager scripts can also be employed to steal payment card data on Magento websites.