Threats and Malware Terms
These are the attacks small businesses and WordPress site owners run into: phishing that steals a password, a fake invoice that redirects a payment, ransomware that locks the office, and hidden scripts that keep a hacked website hacked. Each term explains how the attack works and the warning signs to look for. Each one includes a real case from government records or published security research, with every number linked to its source.
Start here
- Malware: Software, firmware, or code intentionally placed on a system for a harmful purpose, such as stealing data, spying, locking files, or giving an attacker control.
- Webshell: A malicious script planted on a web server that lets an attacker run commands and keep access through a browser, acting as a backdoor.
- Backdoor: An undocumented way into a system that bypasses normal authentication, often planted by an attacker so they can return after the visible damage is cleaned up.
- SEO spam: Links, text, or pages injected into a hacked website without permission to exploit its search reputation, often hidden from visitors with cloaking.
- Casino and gambling link injection: A form of SEO spam in which attackers inject hidden links, pages, or titles promoting online casinos and betting sites into a hacked website.
- Malicious redirect: Code injected into a hacked website that sends some visitors, often only those from search or on mobile, to scam, phishing, or spam pages.
- Card skimmer (Magecart): Malicious JavaScript planted on a checkout page that copies payment card details as customers type them and sends them to an attacker.
- Ransomware: Malicious software that encrypts or locks files and systems and demands payment, often combined with theft of data and a threat to publish it.
- Phishing: A fraudulent email, text, call, or chat message that impersonates a trusted person or organization to steal credentials, deliver malware, or trigger a payment.
- Business email compromise (BEC): A scam in which criminals compromise or impersonate a business email account to trick someone into sending money or sensitive data, often by changing payment details.
- Credential stuffing: An automated attack that tries username and password pairs stolen in one breach against many other sites, exploiting password reuse.
- Supply chain attack: An attack that compromises a business through a trusted supplier, such as a software update, open source library, plugin, or managed service provider tool.
Last updated October 14, 2026.