Half the Checkouts, Once a Month: A Magento Card Skimmer Hidden Inside require.js
A Magento skimmer appended to require.js in pub/static, shown only at checkout to half of visitors, plus GIF/PHP injectors that expire after 180 seconds.
Read Article
Konstantinos K. Bourdakos
Website Malware Removal & Incident Response · Founder & Lead Analyst, KKAA Solutions
I clean hacked WordPress, Magento, Joomla and OpenCart websites: malware removal, backdoor hunting and incident response for site owners, web agencies and hosting providers. Most cleanups are completed within 24 hours and every job ends with a written findings report.
Latest Research
October 8, 2026
October 8, 2026
The Plugin Only Strangers Could See: A Fake Cloudflare Check Hidden From Admins That Survived Its Own Deletion
A fake WordPress plugin showed a fake Cloudflare check to every visitor except admins, then kept serving it from cache after deletion. How to find and purge it.
Read Article
October 5, 2026
The Folder That Beat WordPress: How Gambling Spam Hijacked a Contact Page and Survived a Rebuild
Core was clean, the database was clean, the site had just been rebuilt, and the Contact page still served slot spam. The attacker never touched WordPress: they created a folder. How the hijack works, the hidden file manager behind it, and how to hunt it.
Read ArticleAbout Me
Who Am I?
KKAA Solutions is a specialised cybersecurity and website malware remediation company founded by Konstantinos K. Bourdakos in Athens, Greece. I detect, analyse and remove malware from hacked websites and servers, and document every incident in a written report.
Location
Athens, Greece
Contact
Business
KKAA Solutions (Κ. ΜΠΟΥΡΔΑΚΟΣ & ΣΙΑ Ε.Ε.)
ΑΦΜ/VAT ID: 801985029
ΓΕΜΗ/GEMI: 167601003000
Core Skills
Malware Analysis & Forensics
97%
Application Security
98%
Incident Response
99%
Linux Server Administration
96%
Database Forensics
97%
ModSecurity
98%
Languages
Ελληνικά
English
Work Experience
Malware Remediation Analyst
CloudLinux
I specialize in identifying, analyzing, and mitigating threats in server environments. My role focuses on ensuring system security by detecting malicious activities, removing malware, and implementing robust preventive measures.
Leveraging cutting-edge tools and techniques, I work to safeguard web hosting platforms and enterprise environments against evolving cyber threats.
Founder & Lead Analyst
KKAA Solutions (Κ. ΜΠΟΥΡΔΑΚΟΣ & ΣΙΑ Ε.Ε.)
Registered malware remediation and incident response consultancy serving hosting providers, digital agencies and site owners worldwide. On-demand forensic cleanup of compromised web servers — root cause analysis, backdoor hunting, database inspection, and evidence-backed reporting.
Senior Technical Support
team.blue Group of Companies
Applying state of the art Web Hosting technologies while ensuring the deliverability of our services in a client oriented ecosystem.
Senior IMST
CloudLinux
Providing consulting services of technical support for Imunify360 security products, a next-generation security solution built for Linux servers.
Information Technology Operator
OTE Group of Companies (HTO)
System Administration & Operations of Hellenic Telecommunications Organization SA as part of Deutsche Telekom Group Of Companies. Accounts Involved t-Albania, t-Romania, TMNL, Coca-Cola & OTE Core.
Self-employed
KBourdakos Computer Systems
Duties Involved: Building OEM Systems, Contracts of Support, Sales/Retail, Imports/Exports (EU/USA), In-House Custom App Development, Web Hosting, Customer Support.
Education
Electronic and Computer Systems Engineering
Piraeus University of Applied Sciences
English Language & Literature
University of Cambridge
Computer Science
Queen Mary's College, Basingstoke
Articles
These aren't thought pieces or recycled CVE summaries. Every article here documents a real incident — a compromise I investigated, a backdoor I hunted, a botnet campaign I mapped from first packet to final remediation. The source material is raw: actual access logs, live database dumps, captured HTTP headers, malware samples pulled directly from production servers, and forensic timelines reconstructed from evidence, not theory. Each case represents a real client, a real attack, and a real outcome. Names and identifying details are always protected. The technical depth is never sanitized. If you run infrastructure that matters, these are the exact threats operating against servers like yours right now.
October 8, 2026
Half the Checkouts, Once a Month: A Magento Card Skimmer Hidden Inside require.js
A Magento skimmer appended to require.js in pub/static, shown only at checkout to half of visitors, plus GIF/PHP injectors that expire after 180 seconds.
Read Article
October 8, 2026
The Plugin Only Strangers Could See: A Fake Cloudflare Check Hidden From Admins That Survived Its Own Deletion
A fake WordPress plugin showed a fake Cloudflare check to every visitor except admins, then kept serving it from cache after deletion. How to find and purge it.
Read Article
October 5, 2026
The Folder That Beat WordPress: How Gambling Spam Hijacked a Contact Page and Survived a Rebuild
Core was clean, the database was clean, the site had just been rebuilt, and the Contact page still served slot spam. The attacker never touched WordPress: they created a folder. How the hijack works, the hidden file manager behind it, and how to hunt it.
Read Article
October 2, 2026
The C2 That Hands You Tomorrow's Domain: Anatomy of a Supply-Chain ClickFix Backdoor
A four-hour CDN compromise installed a 3.8 KB plugin through admins' own browsers. Its payload URL lives on a rotating feed, a sibling turns the victim into a first-party proxy, and the loader steals tokens before anyone clicks. Full infrastructure and IOCs.
Read Article
October 1, 2026
The JPEG That Wasn't: A Compressed PHP Backdoor Disguised as an Image
It had a .jpg name and no image inside. A bzip2 archive hid an XOR-encrypted eval() backdoor that the scanner missed. Here is how to unpack it, hunt its loader, and prove the rest of the site is clean.
Read Article
September 30, 2026
The Backdoor Came Pre-Installed: How a Nulled WordPress Theme Shipped Malware That Waited Two Years
Nobody broke in. The backdoor had been on the server for two years — installed on purpose, inside a pirated premium theme. Timestamp forensics proved where it really came from.
Read Article
September 8, 2026
The Malware You Can't Kill: A 15-Layer Self-Healing Framework Is Sweeping Through WordPress Servers
You delete it. It comes back in seconds. A new breed of WordPress malware stores its full payload in the database, rebuilds from 15 independent persistence layers, uses blockchain for command-and-control, and upgrades itself to bypass your signatures — infecting 1,200+ sites in 10 days.
Read Article
August 28, 2026
The SSO Signing Oracle: How a WordPress Plugin's Own Authentication Became the Attack Vector
The server's scanner caught every payload. But the malware kept coming back. Six rotating IPs, zero credentials, and a management plugin's SSO endpoint that handed out admin access to anyone who called it — because step 1 was a signing oracle for step 2.
Read Article
August 26, 2026
Homoglyph Backdoors: How Attackers Hide Malware in Lookalike Filenames
The file was called singIe.php. It looked like single.php. It wasn't. A capital I hiding in plain sight was the only thing separating a WordPress template from a command-execution webshell — and the attacker deployed seven waves of them over two weeks.
Read Article
July 24, 2026
Caught Red-Handed: Fighting an Attacker in Real Time During a WordPress Cleanup
I deleted the backdoor. Sixty seconds later, new webshells appeared on a site I'd already cleaned. The attacker was still inside — watching us work, and re-deploying from a foothold we hadn't found yet.
Read Article
July 15, 2026
Dead Drop: How Attackers Use JSONBin.io to Exfiltrate WordPress Credentials
The malware scanner flagged gambling spam. But buried in a fake plugin was something far worse: a modular exfiltration suite silently uploading passwords, database credentials, and environment variables to a public JSON API every hour.
Read Article
July 13, 2026
You Deleted the Crime Scene, Then Called the Detective
7 in 10 clients restore from backup or wipe malware files before the analyst even connects. They think they are helping. They are destroying everything that matters — and guaranteeing the attacker comes back.
Read Article
July 11, 2026
50 Sites Defaced in 48 Hours: Inside the Joomla Helix3 Mass Exploitation Wave
The files were clean. The malware scanner found nothing. But every page loaded a full-screen skull overlay — because the payload lived in the database, injected through an unauthenticated AJAX handler that no one was watching.
Read Article
July 3, 2026
Ghost in the Process List: A Go C2 Agent Disguised as a Linux Kernel Thread
ps aux showed nothing unusual — just kernel threads. But one was a 5.6MB Go binary with HTTP/2, WebSocket tunneling, and encrypted C2 communication, deployed through a header-based webshell with a backdated timestamp.
Read Article
June 28, 2026
I Set 4 Traps Across 3 Continents. Here's What Crawled In.
4 honeypot servers. 3 continents. 12 AI agents running through the night. In 38 hours I logged 11,547 spam attempts from 872 unique IPs, fingerprinted 6 coordinated campaigns, and deployed a blocklist that cut client spam by 97.4% — before the next wave hit.
Read Article
June 28, 2026
ClickFix on the Blockchain: How Attackers Use Smart Contracts to Deliver Fake Cloudflare CAPTCHAs
Every scanner said clean. No eval(), no base64_decode(). Just ob_start() rewriting every response — with the payload URL stored on a BSC testnet smart contract. Here's how a four-line wp-config.php injection evaded every detection tool.
Read Article
June 25, 2026
Phantom Admin: Inside a WordPress Backdoor That Hides Users and Rebuilds Itself
I ran wp user list. Three admins came back. SQL showed four. The invisible administrator was hidden by the same mu-plugin that rebuilds itself from a 97 KB database payload every time you delete it.
Read Article
June 18, 2026
Invisible Reverse Shells: How gsocket Backdoors Hide in Plain Sight
The crontab looked empty. The .profile had a system comment. The .bashrc seemed normal. All three were hiding gsocket reverse shells using ANSI escape codes that erase themselves from terminal output.
Read Article
June 16, 2026
When the Database Fights Back: MySQL Trigger Malware That Protects Itself
I cleaned the spam. The database undid it. Inside a 4-layer self-healing WordPress infection that uses MySQL triggers to block its own removal.
Read Article
June 12, 2026
Server-Side Magecart: How Attackers Steal Credit Cards Directly from Magento's PHP Checkout
Deep dive into a server-side credit card skimmer injected into Magento vendor checkout files, using multi-pass XOR encryption to silently exfiltrate payment data for 7 months.
Read Article
May 31, 2026
CosmicSting & JFIF Evasion: How Magento Webshells Hide Inside Image Files
How attackers exploit CVE-2024-34102 to deploy PHP webshells disguised as JPEG images, evading scanners that filter by file extension.
Read Article
May 29, 2026
The Malware That Wouldn't Die: Self-Healing WordPress Backdoor
How a WordPress backdoor survives complete file deletion by storing its payload in the database and regenerating itself on every HTTP request.
Read Article
November 27, 2025
Surge in PHPUnit RCE Attacks: What Honeypots Reveal
Analysis of the recent surge in CVE-2017-9841 exploitation attempts targeting PHPUnit's eval-stdin.php for remote code execution.
Read Article
July 6, 2025
wp-compat.php: Malware Backdoor Plugin in WordPress
Analysis of a dangerous WordPress plugin that creates hidden admin users and maintains backdoor access.
Read Article
No articles match "". Try a different keyword.