Case Study: Thirty Sites, Two Keys
A marketing agency's WordPress sites kept serving fake Cloudflare prompts and gambling spam after repeated cleanups. Unrevoked hosting access and stolen admin credentials explained the reinfections.
Read Details
A marketing agency's WordPress sites kept serving fake Cloudflare prompts and gambling spam after repeated cleanups. Unrevoked hosting access and stolen admin credentials explained the reinfections.
Read Details
A law firm's WordPress site kept getting reinfected with ClickFix malware after every professional cleanup. The root cause was not a self-healing virus. It was a valid administrator login that was never rotated. Here is the full investigation.
Read Details
Google Workspace can detect suspicious sign-ins, but alerts only protect you if they reach the right people. Learn how to route, tune, and test admin alerts.
Read Details
A digital-marketing agency hired me to document a Google Ads Manager Account (MCC) takeover that was already cleaned up. The investigation had never been done, so we rebuilt it from the logs and found the real root cause: a terminated employee's account that was never disabled.
Read Details
A boutique advisory client's two WordPress sites were compromised through administrator access left over from the freelancer who built them: rogue admin accounts, gambling spam, and a file-manager backdoor. A full forensic remediation evicted the operator and cleaned and hardened both sites.
Read Details
An established watch brand's Shopify store was blocked by Avast and AVG as dangerous. It looked like a hack, but a full forensic audit found no compromise and traced the blacklisting to the brand's own ad campaign and an abandoned tracker.
Read Details
An aged-care provider's WordPress site kept reinfecting after prior cleanups, with gambling spam and Search Console hijacks returning. The cause was database malware, two backdoors, and a stolen admin credential.
Read Details