A law firm's WordPress site kept getting reinfected with ClickFix malware after every professional cleanup. The root cause was not a self-healing virus. It was a valid administrator login that was never rotated. Here is the full investigation.
Read Details
Google Workspace can detect suspicious sign-ins, but alerts only protect you if they reach the right people. Learn how to route, tune, and test admin alerts.
Read Details
A digital-marketing agency hired me to document a Google Ads Manager Account (MCC) takeover that was already cleaned up. The investigation had never been done, so we rebuilt it from the logs and found the real root cause: a terminated employee's account that was never disabled.
Read Details
A boutique advisory client's two WordPress sites were compromised through administrator access left over from the freelancer who built them: rogue admin accounts, gambling spam, and a file-manager backdoor. A full forensic remediation evicted the operator and cleaned and hardened both sites.
Read Details
An established watch brand's Shopify store was blocked by Avast and AVG as dangerous. It looked like a hack, but a full forensic audit found no compromise and traced the blacklisting to the brand's own ad campaign and an abandoned tracker.
Read Details
An aged-care provider's WordPress site kept reinfecting after prior cleanups, with gambling spam and Search Console hijacks returning. The cause was database malware, two backdoors, and a stolen admin credential.
Read Details
How WordPress sites actually get hacked, what malware does once it's in, what cleanup means, and how to tell whether the advice you're getting is sound. Written for owners who run their own site and for owners working with a developer or agency.
Read Details