Massive infections of websites are common nowadays, blindly infecting as many sites as possible. Once these sites are compromised, the access is usually sold to cybercriminals. At this point the site hosts malware or redirects victims to some exploit kit. Almost all the malicious detections occur in JS files, basically JS tricks to redirect the user to malicious sites. The group behind these infections has been using some old WordPress and plugin vulnerabilities. The most interesting thing to me is how all these sites got infected. They have no common pattern in the technology they use.”]