Fake DDoS-Protection Pages on WordPress Sites Serve Up Malware

A group of hackers has been using fake DDoS-protection pages to trick unsuspecting users into installing malware, according to GoDaddy-owned cybersecurity firm Sucuri. 

Hackers are hijacking sites built with WordPress to display the fake DDoS-protection pages. Those who visit these sites see a pop-up that masquerades as a Cloudflare DDoS-protection service. But once they click the prompt, the pop-up will download a malicious ISO file to their PC. 

The attack exploits how DDoS-protection pages will sometimes appear on websites you try to visit, in a bid to stop bots and other malicious web…