Website Malware and Defacement: Catching Attacks with Continuous Monitoring

When a website gets compromised, the malware is rarely dramatic. No ransom note on the homepage — more often a quiet injection: a three-line script in the footer that skims card numbers, a hidden page farm serving spam content to search engines, a webshell waiting in an uploads directory. The attack succeeds precisely because nothing looks broken from the outside. By the time anyone notices — usually a browser warning, a search-engine blacklisting, or a customer complaint — the malware has been running for weeks. This guide covers how website malware behaves, what defacement detection involves, and how continuous monitoring shortens that window from weeks to hours.

The Main Malware Classes on the Web

Payment skimmers (the Magecart pattern)

A small script injected into checkout pages reads card details as the customer types them and exfiltrates to an attacker-controlled domain. It leaves the site fully functional — that is the entire point. Skimmers rotate domains, obfuscate code, and sometimes load only for specific regions or device types to evade manual inspection.

Webshells

A webshell is a script (often dropped through a vulnerable upload form, an exposed file manager, or a stolen FTP credential) that gives the attacker a remote control panel: browse files, edit code, execute commands, upload more malware. Webshells are the persistence mechanism — cleaning the initial infection without finding the webshell means reinfection within days.

SEO spam and redirect chains

Compromised sites get repurposed as link farms: hidden directories stuffed with pharmaceutical and gambling content, cloaked pages that serve different content to search-engine crawlers than to users, and conditional redirects that send organic traffic to scam sites. The operator's loss is subtle but severe — search rankings collapse, and the domain can end up blacklisted.

Defacement

The loud variant: the attacker replaces the homepage with their message. For government, education, and news properties, defacement is the most visible security failure that exists — screenshots circulate for years. Defacement is usually the end of an intrusion that began weeks earlier with a credential or a plugin vulnerability, which is why defacement monitoring and malware detection belong in the same pipeline.

Malicious redirects and script loading

Compromised sites are frequently used as distribution: injected <script> tags loading exploit kits, or .htaccess/server-level redirects ferrying visitors to phishing and malware pages. Your site becomes the trusted brand that launders the attack.

How Malware Actually Gets In

The entry paths are stable across years of incidents:

• Stolen credentials — admin passwords from infostealer logs, reused passwords, or credentials exposed in public repositories (see our infostealer guide for how this pipeline works)
• Vulnerable plugins, themes, and components — especially in the WordPress ecosystem, where a single popular plugin vulnerability exposes hundreds of thousands of sites overnight
• Outdated server software — a CMS or framework version with a public exploit
• Exposed services — an open admin panel, an upload endpoint without validation, a database port facing the internet
• Supply chain — a compromised dependency or update channel

Each entry path has its own scanner family; malware detection is the layer that catches what got through anyway.

How Continuous Detection Works

The detection principle is simple to state and hard to do well: know what your site normally looks like, and alert when it changes in ways that matter. In practice, this decomposes into:

1. Content anomaly detection — a behavioral baseline of page structure, scripts, links, and outbound references. New external script domains appearing on checkout pages, iframe injections, hidden display:none content blocks — changes like these are flagged against the baseline rather than against a static signature list, which catches novel injections that no signature database has seen yet.
2. Webshell detection — filesystem-pattern and content-pattern scanning for command-execution primitives in web-accessible locations, keyed to how real webshells are built rather than to a fixed filename list.
3. Skimmer and malware detection — pattern families for the actual malicious behaviors: keystroke capture on form fields, card-number-shaped data exfiltration, encoded-payload loaders, and known-bad script infrastructure.
4. Defacement detection — homepage and key-page content monitoring with structured diffing, tuned to distinguish a legitimate content update from a replacement.
5. Reputation correlation — blacklist and reputation feeds (the lists that browsers and search engines actually consume), so you learn from monitoring rather than from your visitors' antivirus warnings.

Evidence matters as much as detection: a good alert includes what changed, where, and when it first appeared — the difference between a five-minute cleanup and a forensic archaeology project.

When You Find Malware: the Response Order

1. Take a forensic copy first — before cleaning, preserve the infected state; you will need it to find the entry point
2. Clean completely, not partially — remove the injection and hunt for persistence (webshells, rogue admin accounts, cron jobs, modified core files)
3. Rotate everything — credentials, API keys, database passwords, SSH keys; assume all were exposed
4. Patch the entry path — or you are scheduling the reinfection
5. Request blacklist reviews — search engines and browsers have removal processes; start them the same day
6. Check your users — if skimmers ran on checkout, your disclosure obligations probably started yesterday

Monitoring Beats Auditing

Annual penetration tests and post-incident forensics both have their place, but malware economics reward speed above all: the cost of an infection compounds daily (data stolen, users harmed, reputation decayed, blacklisting duration extended). Continuous monitoring is the control that converts "compromised for six weeks" into "compromised for six hours."

The 2MNY platform runs the full monitoring family described above as part of its continuous scanning — content anomaly detection, webshell and skimmer detection, defacement monitoring, and reputation correlation. Run a free scan to baseline a property you manage, review the complete scanner list, or self-host the open-source engine core from GitHub.

Related reading: Infostealer Logs and Credential Leaks · Why Continuous Monitoring Matters · WordPress Security: 10 Essential Steps