[wp-forums] FYI: New hack - symptoms

[Mika A Epstein]

If anyone's on DreamHost, lemme know and I can look.

esmi at quirm dot net wrote:
>
> I've seen a few reports of this recently.
>
> Symptoms: the OP says that all text on the site has suddenly become
> italic.
>
> Cause: a hidden div immediately after the opening body tag containing
> a link to Best Payday Loans.
>
> Not sure where this is being inserted. Possibly the theme's header.php
> template file? Anyone had a chance to look deeper into one of these
> sites?
>
> Mel