YT YouTube2Text

YouTube2Text → Transcripts → Malware That Shows AI a Clean Site (And Your Visitors Malware) | WHT S3E14 | Aaron Campbell - Monarx

Malware That Shows AI a Clean Site (And Your Visitors Malware) | WHT S3E14 | Aaron Campbell - Monarx — Transcript

by WebhostingToday · 5,951 words · 945 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00In the new reality, we sort of have to
0:01figure out how much of a customer's mess
0:05and [music] mistakes and poor code can
0:08we realistically
0:10protect against?
0:11>> Security in web hosting has drastically
0:13changed in 2026.
0:15>> [music]
0:16>> AI have made hackers much more effective
0:18and their tools much more sophisticated.
0:21There's not a single week without a new
0:23vulnerability in one of the key software
0:25that's running hundreds of thousands of
0:27sites.
0:29>> If a Disney had a problem, they probably
0:31would do a full forensic audit and
0:34figure it out. But if like my mom's
0:36website has a problem, she doesn't need
0:39a full forensic audit.
0:41>> And she doesn't even know what it is.
0:43>> [laughter]
0:43>> So, in this special episode of Web
0:45Hosting Today Podcast, together with
0:47Aaron Campbell from Monarchs, we share
0:49five stories that hosting providers may
0:52have already experienced or might face
0:55in the near future. This is the new
0:57reality that we're living in.
0:59>> I think that we all need to take a
1:00little bit of a step back and say AI has
1:02changed things. What needs to be our new
1:05normal? And it's going to take some
1:07shifting.
1:08>> And it's not like we're making this up.
1:10These stories have actually happened.
1:13Enjoy.
1:15All right, Aaron. So, let's start with
1:16the first one and my favorite one.
1:18Imagine a customer reporting that their
1:20website is infected and redirecting
1:22visitors to suspicious pages.
1:25Your technical team verifies it and
1:28everything looks fine. You ask an AI
1:30assistant to investigate and it also
1:32finds nothing suspicious.
1:35But the customer is right. The website
1:37is really infected.
1:40So, what happened? Turns out there's a
1:42malware campaign called Parrot TDS and I
1:45guess this is the name of the
1:48this one campaign.
1:49>> So, there will absolutely be more, yeah.
1:51>> Yeah, that can recognize who's visiting
1:54a website and serve different content
1:58depending on the visitor. Some newer
1:59versions can even recognize AI crawlers
2:03showing them clean content while sending
2:05real visitors to malicious websites. But
2:07is that was my favorite one because it
2:10sounds like it's you know it so obvious
2:13and so simple but it it sounds so
2:15effective at the same time. So so I
2:17guess what what do you think? What can
2:18you do about it?
2:19>> Hey, it it really is effective. You're
2:22you're right. One of the interesting
2:24things here and I think that it's kind
2:25of a
2:26probably going to be a through line to a
2:28lot of what we discuss about how AI is
2:30changing things.
2:31A lot of the basis of what is happening
2:35is still
2:37the same. It's like the same old tricks
2:39but AI is making it much easier, much
2:42faster, much cheaper and
2:45and and introducing some new tricks and
2:47stuff along the way. So this is
2:49something we've seen for a while where
2:52maybe it would show a clean site to
2:55users but to the Google crawler it would
2:58show, you know, ads for some, you know,
3:02medical product or whatever it is that
3:04they were trying to to sell. And now as
3:06more people are using
3:09AI to
3:11clean or fix a problem
3:14they've flipped that and now they're
3:16showing bad content to real users and to
3:20the AI that might be trying to come in
3:22and clean it up they're showing a
3:24perfectly clean site.
3:27And it can be really difficult and it it
3:30highlights
3:31how much we have started to rely on AI
3:35to fight this kind of stuff. It's an
3:38interesting twist on an old problem.
3:41>> Yeah.
3:42And this is like when you look at it
3:44it's it's all fine. So in my I imagine
3:46there's a support case where there's
3:48someone reporting an issue and it's like
3:50going back and forth and nobody's
3:52understanding what's happening on until
3:54I guess you get into the code. But I
3:55also imagine that AI
3:58because it can produce the code so fast
4:02it can make so much sophistication in
4:05this
4:06It can hide different things. It can
4:08encrypt different things here and there
4:10and like you can almost entirely
4:13automate this whole process to do every
4:16single attack different to some extent,
4:19right?
4:20>> It's It's interesting because
4:22you're right, it can
4:25adapt very easily including things like
4:29maybe your support team are generally on
4:31your VPN and are therefore coming from
4:34certain IP subsets. If it can recognize
4:37that and always show them clean
4:39regardless of whether it's a person or a
4:42tool, right? These are the kinds of
4:43things that AI very quickly adapts to.
4:47It It might be a trick that somebody
4:49else would have thought of in the past,
4:51but it happens so fast and so easily now
4:54with AI.
4:55And when it comes to hosts, like this
4:57really shows
4:59this interesting balance with our
5:01support teams that we need to have. AI
5:05tools can help our support teams be so
5:08much better at their job, right? Be able
5:11to find answers so much faster, be able
5:13to check sites so much easier, be able
5:16to dig deeper than they were before. It
5:18can also even answer a lot of the simple
5:21questions that used to take a lot of
5:23support's time, so support can spend
5:25more time on each ticket, all kinds of
5:27things, but
5:29that doesn't mean that that is the
5:33panacea. That's not the solution to
5:36everything. You can give them AI tools,
5:38but they still need training for what
5:40happens if that tool comes back and says
5:43everything is clean, but the customer is
5:45sending a screenshot showing that it's
5:47not, right? Something is actually amiss,
5:50what do you do? So, it's it's almost
5:53like a different kind of training for
5:56support now. It's like how to use all
5:58your tools and also how to know when to
6:02do something outside of your tools, like
6:04take a look in a different way,
6:06disconnect from the VPN and load the
6:08site. Like it's we have to teach them
6:13what the current AI and and even just
6:16general attacker tricks are, so that
6:18they know how to properly identify them.
6:21It's a whole new set of training for
6:23a huge part of every host, every every
6:26support team.
6:28>> All right, so time for advertisement.
6:29What what's Monarchs doing with it? How
6:31is Monarchs making it easier? Do you
6:34have an academy? Do you mean just the
6:35the the training part or also in terms
6:38of solution? How can you recognize so
6:39many different attacking angles and
6:41different methods? How is this even
6:43working?
6:43>> The biggest thing here is being at so
6:45many different layers. Monarchs has a
6:48bit of an advantage there. Yeah, we see
6:50requests coming in at the at the network
6:54layer. We see them being processed in
6:57the in the runtime, so we see what's
6:59happening and what's being served. We
7:01also sit
7:02on the server itself and are observing
7:05every file. What is the code in the file
7:08and identifying the malicious code. And
7:11it's those second two like those latter
7:14two layers that help us identify this
7:18kind of thing, because it doesn't matter
7:20who that visitor was, we're still
7:24looking at that request and response and
7:27saying that's not normal. We should pull
7:32the files that are generating that and
7:34investigate. And that's how we that's
7:37how we find stuff. That's how we found
7:39this one. And it's it's it's essentially
7:43the the best practice of having
7:45protection at every layer is kind of a
7:47must now and that's that's how Monarchs
7:50solves this and and gives our customers
7:54insight into it through our through our
7:56dashboards and and and whatnot. But the
7:59biggest thing is just how much of this
8:00can we just solve for them, right? If
8:03this never becomes a support request,
8:06it's even easier than training the
8:08teams.
8:10>> Guys, let's stop for a second.
8:11>> [music]
8:12>> This podcast and the entire Web Hosting
8:14Today wouldn't be possible without our
8:16amazing sponsors.
8:18Monarchs, Patchstack, Aathari, UltaHost,
8:22[music]
8:23NameHero, Extendify, and AdminBot.
8:27Big thanks to these guys, and of course,
8:29if you'd like to join them, feel free to
8:30reach [music] out.
8:32Story number two.
8:34And this is actually also interesting.
8:36Hosting support teams are increasingly
8:38receiving requests for detailed forensic
8:40reports, attack timelines, and root
8:42cause analysis after website infections.
8:46And in many cases, customers expect all
8:48of that as part of their regular hosting
8:51support. A few years ago, a hacker
8:53customer would simply write, "My website
8:55is infected. Can you fix it?" Right? Or
8:57you can send in the the screenshot, like
8:59you said.
9:00Today, many of them ask ChatGPT first,
9:03and suddenly your support team receives
9:06a professionally written ticket
9:08requesting server logs,
9:10the attacker's IP address, the exact
9:12vulnerability exploited, and a complete
9:14explanation of what happened. And
9:17obviously, the problem is that ChatGPT
9:19doesn't have all the details and all the
9:21context, so it can just figure things
9:24out that are wrong. And for you and your
9:27support team, it can mean that it it can
9:29even take take a couple of hours or even
9:32days to figure out what like prepare all
9:34the all the reports. Yeah, so what's
9:36your take on this?
9:38>> This this is a challenging one. If if
9:40you've ever just asked AI, like,
9:43"Solve this problem." Sometimes, it's
9:46solutions can be very complex in ways
9:50that are
9:51beyond the norm. And when it's in
9:53technical the technical space,
9:55there's so much data that they've been
9:58fed that they're
10:00very, very
10:01knowle- like contain a lot of data and
10:04are therefore seeming very knowledgeable
10:05about that. But it can be way too much.
10:09A support ticket can come in and and and
10:11if it's been written by ChatGPT, it can
10:13be
10:14three, four pages of text, and that's
10:17that takes so much time just to read
10:20through. It puts all the weight on that
10:22support person. It asks for unreasonable
10:25things, you know, it wants full forensic
10:28investigation, and sure, that would be
10:31that would be great. And and companies,
10:33you know, a big company like if a if a
10:35Disney had a problem, they probably
10:37would would do a full forensic audit and
10:40figure it out. But if like
10:44my mom's website has a problem,
10:46she doesn't need a full forensic audit,
10:49right? Like she needs it fixed.
10:51>> even know what it is.
10:52>> Right. And if all that data came back,
10:55she wouldn't know what to do with it.
10:56She'd pass it back into ChatGPT, and it
10:58would probably spit out more questions,
11:00right? And the back and forth can be
11:03forever that that way when you're
11:06essentially talking to an AI instead of
11:08the customer.
11:10I think that this is another place where
11:13training is really important for support
11:16teams, and this one is more around
11:18training for communications.
11:21>> I can give you an example because we are
11:22implementing Coronado AI with it with
11:24some of the hosters, and
11:27very often they even told told me that
11:30if a customer writes like a
11:32big wall of text that it's clearly AI
11:35because nobody, you know, writes it.
11:37They just put it into their own AI or
11:40use Coronado AI, and they generate the
11:42entire message back. So, it's like
11:44basically AI agents talk with each other
11:46instead of people. And well, I guess
11:49this is just a new reality that you have
11:50be in and and and adapt, yeah.
11:53>> It's it's interesting though because you
11:56do have the human generally reads the
11:59first
12:00little bit of your response. They may
12:03feed the whole longer response just into
12:06their AI, but I do think that there's
12:09there's still something there around
12:11acknowledging the issue and and saying
12:13it's been fixed or or what to do to fix
12:15it in that first couple sentences and
12:18then
12:19you know, letting AI sure continue on
12:21with the well, you know, you can get
12:24your server logs over here and these
12:26kinds of things are available and these
12:29kinds of things aren't.
12:31It's it's difficult too because a lot of
12:34to your point like chat GPT didn't
12:36really know
12:38what the issue was. So it's like
12:40data collection possibilities, right? So
12:43there's a big difference between what's
12:45confirmed that the support person might
12:48see and what's hypothesis guesses that
12:51the chat GPT made and so trying to
12:54straighten all those out
12:57it's time-consuming.
12:58>> Yeah.
12:59>> And so I guess if if your AI can
13:01straighten those things out, if you can
13:02train it to do that, here's what's
13:04confirmed, here's what's
13:07what that what your AI was wrong about,
13:10that would definitely be time-savings.
13:13Having Having the data available though
13:16to answer these questions is even
13:19somewhat hard for hosts, right? Server
13:22logs are fine.
13:24But the full backtrace of like what
13:27actually happened, where the malicious
13:31file came from, that can often be hard
13:34for hosts to even have available to
13:38themselves, much less make available to
13:40that end user.
13:41>> Yeah.
13:42Yeah. And I think there's also aspect
13:45because you said that Disney isn't
13:48paying $20 per Okay, maybe not per year.
13:51Okay, let's say $50 per year for their
13:54hosting account, right? They have
13:56managed hosting provider that is really
13:59getting premium for keeping everything
14:01in check. But if we are talking about
14:03those unmanaged cheap hosting providers
14:06that are big in scale, it's physically
14:10even not possible to do this. And you
14:12know, we've been talking about it in in
14:14episodes already that educating
14:17customers that this is not included or
14:20maybe you need to pay for security or
14:22maybe there's some extra fees because
14:25it's not clear for customers where their
14:28responsibility ends. I think that's also
14:31an a tricky part.
14:32>> And I think that every one of these
14:34kinds of contacts is a potential chance
14:37for a security upsell. Not not not
14:41taking advantage, but offering a thing
14:44that could have
14:46protected them or that could help
14:47protect them the next time. There's a
14:50there's a fine balance between when you
14:52offer that, right? Offering that while
14:54their site's still broken, that that's
14:57probably not going to induce great
14:59sentiment, but fixing their site and
15:01then offering them a way to prevent it
15:03in the future, you can actually come
15:05across as
15:07the hero and also they'll pay for a
15:10security product to to help keep it from
15:12happening again. No one thinks it's
15:14going to happen to them until it does.
15:16So once it does is a good time to to
15:19talk to them about prevention.
15:22>> Mhm. Okay, so with Monax, what can I do?
15:26Is it easier with Monax to to handle
15:29such situations?
15:30>> I think the biggest thing that we do
15:31here is we have a really powerful
15:33backtrace tool that our customers can
15:38use to help investigate and figure out
15:41where that malicious file came from. We
15:44we can see like like I said, we sit in
15:47the runtime, we watch what's happening,
15:49we watch every file, right? So often you
15:52can trace that all the way back to
15:55this was done through the WordPress
15:58plugin uploader and and here's here's
16:02when it happened and how. And being able
16:05to offer that to your custom to your
16:07your end users, that can be really
16:09challenging on your own, but but with
16:11our tools it makes it much easier.
16:15>> When is the best time to sell a hosting
16:16company? Is it now or maybe in 5 years?
16:19The truth is there is no simple answer.
16:22>> [music]
16:22>> Every situation is different. That is
16:26why it helps to talk to someone with
16:27real experience in hosting M&A. Someone
16:30who deals with this every day. If you
16:32want to understand your options, get in
16:34touch with us for an honest
16:35conversation. Completely confidential,
16:38no commitments.
16:39And next story.
16:41In July 2026, a security researcher
16:44discovered a critical vulnerability in
16:47WordPress itself using AI. Doesn't sound
16:49like a like a new thing nowadays, right?
16:51Um
16:52it took around 10 hours and cost just
16:54$25 to be able to take complete control
16:58of any WordPress website. Uh WordPress
17:00released an emergency patch on July 17th
17:03and within days and probably within
17:06hours with the technology, attackers
17:09were already exploiting it. And because
17:11you can just get your AI analyze what
17:15was updated in WordPress, reverse
17:17engineer, and prepare an attack for for
17:20this code. One security company recorded
17:22nearly 2 million attack requests
17:26in just 9 days and researchers confirmed
17:28actual compromises and backdoors. And
17:32and obviously this isn't an isolated
17:34problem because in September, there was
17:36another critical WordPress vulnerability
17:38that triggered over 20,000 blocked
17:41attack attempts reported by Monarx
17:44alone. Yeah, I guess this is this the
17:47the new reality that we're in.
17:48>> Yeah, this one was this one was
17:51fun? I don't know if fun's the right
17:53word, but this one was super
17:54interesting. Uh that this is WP 2 Shell,
17:57right? The um it it got its own name. It
18:00was it was probably the most severe
18:04WordPress vulnerability that WordPress
18:06has had in maybe 10 years or so. And it
18:10was found by AI and found pretty
18:13affordably to your point. It was what
18:14what he he estimated $25 worth of of of
18:18token usage.
18:20The interesting thing here, a couple
18:23things to point out. One,
18:25does $25 replace an expert?
18:28No. I I think that the the interesting
18:31thing is is what an expert was able to
18:34do with AI. Somebody that really knew
18:36what they were doing
18:38was empowered by AI to do much more.
18:42This This vulnerability chained together
18:45several things that frankly were were
18:49surprisingly
18:51complex. Um
18:53as someone who worked on the the fix and
18:55and helped
18:57uh review patches and stuff for it. It
18:59was It was complex, but this is normal
19:02now. AI is chaining together
19:0515, 16, maybe more steps to get to a
19:10vulnerability. And to your other point,
19:13how quickly it's being exploited,
19:16WordPress has always had
19:19bad actors watching our open-source
19:21codebase. Um for a while, I ran the
19:24security team for the WordPress project,
19:27and I stopped committing security
19:29patches because people knew that when
19:33Aaron did the commit, it was probably a
19:34security thing. Go look real close and
19:37see if it was.
19:38Um but now people just have AI
19:40monitoring it full-time, and as soon as
19:43a security release comes out, it reverse
19:45engineers it and immediately starts to
19:48exploit it. That that gap is almost
19:51nothing. You were saying that that
19:54someone had reported millions of blocks
19:57in the first 9 days or whatever. The The
20:00more interesting thing to me is that we
20:02saw tens of thousands within about 5 to
20:0610 minutes of release.
20:09>> Okay.
20:09>> 5 to 10 minutes.
20:11That's really fast. And so, the
20:16practical issue for hosts becomes
20:18how quickly can you protect your
20:20customers
20:22while they update? Right? Um
20:25>> Yeah.
20:25>> It It takes more than 5 to 10 minutes
20:27for most of your customers to update. No
20:30doubt, it takes
20:31way longer than that. So, how quickly
20:33can you protect them in the meantime?
20:38>> It's It doesn't sound sensational
20:40because we've been through this and it's
20:41been in July, right? But, I think there
20:44was even something about WordPress
20:45having problems or like Correct me if
20:49I'm wrong, but I think they were like
20:50going back and forth with different
20:52approaches how to deal with
20:54vulnerabilities
20:56because there were some some uh new
20:58policies around uh plugins. There were
21:01some delays in like there was a little
21:04mess in how to actually deal with that
21:07from the WordPress angle, right? And
21:10>> If I'm to throw my WordPress hat on real
21:12quick and talk a little bit more from
21:13the project side rather than the Monarch
21:15side,
21:16>> Yeah.
21:17>> AI is shifting things even in open
21:19source projects like WordPress. A a few
21:21things that that you're talking about,
21:23the plugin directory, we had to uh
21:26essentially implement uh delay between
21:30when
21:31a commit to a plugin happens and when
21:35that package is actually made available
21:39through the WordPress update function
21:41because we needed We were having
21:43problems with everything from AI sort of
21:47taking over supply chain things and it
21:50ending up in plugins
21:52to AI just breaking into someone's
21:55account and and uploading plugin changes
21:58on their behalf. It became more prolific
22:00and we needed to
22:02shift that in a way that we could
22:04protect users. We have AI that's running
22:07to check the safety of each of those and
22:10we've been able to reduce that time
22:12between commit and release.
22:16But, it it it really became a whole new
22:18paradigm that we needed to deal with.
22:20And on the security team side, we used
22:22to get I mean, it's it's a big project.
22:24You'd get a dozen plus reports a week
22:29and in busier times you'd get, you know,
22:31maybe that
22:33in in a day if there was a real
22:36I don't know, flood of them for
22:37something, you know, but
22:40now we're seeing
22:42like more than one vulnerability report
22:46an hour being submitted because
22:48everyone's got AI trying to find issues
22:50in WordPress and submitting them and
22:53it's
22:54a volume that's difficult to deal with.
22:57I mean,
22:58AI lowers the cost, increases the speed
23:01and expectations.
23:02And so all of that is shifting how
23:05projects like WordPress are able to or
23:08or need to deal with that.
23:11>> Yeah. Yeah. Yeah. So on this WP-2 shell
23:14exploit, what what did Monarchs do or
23:17let's say
23:19how was it better to be a Monarchs
23:21partner and then not during this attack?
23:24>> Yeah, this one we worked together with
23:28WordPress security team to
23:32the the security team has an an official
23:35group that has some hosts, some security
23:37companies, some laughs and CDNs in it
23:41that can help protect users from these
23:44kinds of things
23:45before the release. So we actually we
23:48worked with them, we got a little bit of
23:50advanced notice. It's not a lot, but our
23:52team is fast. We turned it around and
23:54got patches in place
23:57for via threat shield before the release
24:00even went out, which is how we were able
24:02to see and block many of those tens of
24:06thousands of tax of attacks even in the
24:08first 5 and 10 minutes because our
24:10protection was out before the release
24:13even went out. So those AI agents
24:17didn't have a chance to try to exploit
24:18it before we were protecting against it.
24:21And as that time to exploit continues to
24:23shrink, that's going to become kind of
24:26the new necessary standard to protect
24:28your users.
24:30>> May I ask because actually this brings
24:31me a question. So if I understand
24:33correctly, if you're working closely
24:35with the WordPress, and of course it's
24:37not only Monarks, but there's a group,
24:39right? If you
24:41if you find an exploit in WordPress, do
24:44you work together before it is published
24:47anywhere? Is this how this work?
24:49>> Absolutely. If if we find a a a
24:52vulnerability and exploit in WordPress,
24:55we would report it through WordPress
24:57uses HackerOne. Um we would report it.
25:00They would be able to we would work with
25:03them and let them,
25:05you know, find the fix or maybe we
25:06supply the fix, plan the timing of the
25:09release, all of that.
25:12We would coordinate
25:13publishing with the release so that
25:18we're not giving anyone advanced notice.
25:20Now, it it it in some ways it's
25:24it it makes sense as a security company
25:27just to build the protection into your
25:29tool and then
25:31publish, but that's bad for everyone
25:34else and we want to be kind of good
25:36citizens on the internet in general and
25:38so we would we would do it that way.
25:41>> Yeah, okay. No, totally makes sense. So
25:43so so your tools and your customers and
25:46and obviously [clears throat] others as
25:47well
25:48can be protected before it gets leaked
25:51and before it's announced and before
25:52these hackers can automatically run the
25:55exploits.
25:56>> Look, I I think that I want to make
25:58Monarks better than than every other
26:00solution out there. However, I also just
26:03generally want to keep everyone on the
26:05web safer. And so coordinating with
26:09other companies helps us do that.
26:12>> Absolutely.
26:13All right. Another another story which
26:15is also a nice exploit. You know, I'm a
26:18technical guy so I I just love these
26:20stories that are
26:21more into what actually happens on the
26:23website. In August 2026, Monarks
26:26published published research into a
26:29particularly nasty WordPress malware
26:31campaign.
26:32Once this malware infected a website, it
26:37could spread to other WordPress
26:39installations sharing the same hosting
26:41account, which is not unusual, but the
26:46the the difficult part was that this
26:48malware could rebuild itself after being
26:51removed using hidden copies, database
26:54entries, and even
26:56the website administrator's browser.
27:00So, a customer could clean this up. You
27:03can even report it to your support. They
27:05say that it's all working fine, and
27:07within a few hours you have this
27:08infection back, and you don't even know
27:10where does it come from. And I can
27:13relate to that because, you know, I'm
27:15using my wife's website very often
27:17because she is running Someone made her
27:19a WordPress site many years ago, and I'm
27:22the one who is maintaining it, and and
27:24I'm regular regularly cleaning malware,
27:27and
27:29at some point I just had to
27:31download all the all the files, run it
27:33through AI just to clean it up, and
27:36upload it again into a clean account
27:37because it was just not possible to find
27:40all these files and everything. And I
27:43can also imagine that we were talking
27:44about it, but these tools are getting so
27:46much sophisticated and so tricky in many
27:49ways that I just can't imagine people
27:52are doing manual malware removals like
27:56it was in the past, right?
27:59>> We do still do manual malware removals,
28:03but you don't do that
28:06as the whole solution, right? Like we we
28:09we use our tools to do the vast majority
28:11of it, but like you said, some of this
28:14stuff is really tricky, even tricky for
28:17your AI to find until you've been able
28:19to give it enough data and examples to
28:22be able to better understand it. So, we
28:24use human-based
28:27cleans from our threat research team
28:29going in and and manually cleaning a
28:31site to identify those things that
28:36that weren't known before to to
28:38essentially write new rules for our AI
28:41to follow to be able to identify that in
28:45the future, which is one of the big
28:47takeaways from this one. I think that
28:49there's there's a few here, but one of
28:51the big takeaways is that often
28:55cleaning something for one customer
28:59really needs to not only apply to that
29:03whole account, but the learnings from
29:05that need to apply
29:07everywhere because otherwise those these
29:11campaigns again, AI is changing cost,
29:14speed, and expectations and that cost
29:16and speed is making these things just
29:19spread like wildfire.
29:22And so you really need to be able to not
29:24just clean it, but clean it and
29:26implement that knowledge everywhere,
29:28which is what we do.
29:30I think the other big thing is another
29:32big takeaway from this is that
29:34cross-site
29:36and and not even just within the
29:37account. This one had the ability to
29:40store itself in your browser memory and
29:43then infect new sites that you logged
29:45into.
29:46>> That That was actually crazy, yeah.
29:48>> Yeah, yeah. I mean that was that was
29:50novel and new and and in that case
29:53there's really
29:54in the past there would be hosts would
29:56throw our arms up and say, "Well,
29:57there's there's nothing we can do about
29:59this." But in the new reality, we sort
30:02of have to figure out
30:04how much of a customer's
30:06mess and mistakes and poor code can we
30:11realistically
30:12protect against? What are additional
30:15protections that we can put in place
30:17to try to mitigate this as as much as
30:20possible.
30:22And so you you used to have real strong
30:25bounds between accounts so that one
30:29customer couldn't infect another
30:31customer. And that's great, but now
30:35maybe we need some of those bounds
30:37between
30:38individual sites that a customer's
30:41running if they're running two or three
30:43sites on one account in the same kind of
30:45way to create to avoid cross
30:49or in in inside account cross site
30:52re-infection.
30:54I think that we all need to take a
30:55little bit of a step back and say AI has
30:57changed things. What is what needs to be
31:01our new normal? And it's going to take
31:03some shifting.
31:04>> All right. And the final the final fifth
31:08story. Imagine your customer hosts an
31:11online store and he keeps everything
31:14updated, follows all the security
31:16recommendations,
31:17and still gets hacked. And now you're
31:20the one who needs to figure out what
31:21happened even if it's not a managed
31:24service. That's That's exactly what
31:27happened to a WooCommerce store earlier
31:29this year.
31:30The attacker found an unknown
31:32vulnerability in a paid gift card plugin
31:35and used it to upload malicious files,
31:38establish hidden access, and prepare a
31:40complete website backup to steal its
31:43data. And obviously the tools used in
31:46the attack appear to be AI generated.
31:47It's not a It's not a surprise.
31:50Um but you know, the store was running
31:52the latest version of the plugin, latest
31:55version of the WordPress. It was
31:56following the rules. And and like what
31:59can you do about it?
32:00>> [snorts]
32:01>> Yeah, so this is the the the kind of the
32:03speed and cost thing really coming into
32:06play heavily, right? This was a paid
32:10WordPress plugin with
32:12I mean, decent distribution, but
32:16it It's not like it's WordPress on, you
32:18know,
32:20tens of millions of sites.
32:22But and so it it may not have been a
32:25target that a
32:27uh malicious actor before would have
32:30attempted to really break into because
32:33the the effort for for return on on on
32:36your time just wouldn't have been great.
32:40But with AI people just hey, check
32:44all of these, everything that you can
32:46see and find and find exploits. And when
32:49you find them, immediately start to
32:52exploit them. Um and so that's what
32:54we're seeing. We're seeing a lot more of
32:55what what we call zero days, right? The
32:58a thing that's being exploited before
33:02it's been
33:03reported, fixed, patched, etc.
33:06>> Mhm.
33:06>> And that's that's what happened here.
33:08And that means that that the site owner
33:11did in fact keep everything up to date.
33:13They did all the right the right things
33:16at least as far as we could tell
33:18and still got
33:20hit. And so in these kinds of cases it
33:24it like it really highlights how you
33:27have to go beyond
33:29the
33:31old paradigm of
33:34identify
33:36patch roll out those patches, you know,
33:40update everybody because
33:43that's too slow. We have to get ahead of
33:46them now. [clears throat]
33:48>> And what do you do with the those
33:49zero-day attacks?
33:51With Morpheus?
33:52>> So the reason that we found this one is
33:55that our runtime protection started
33:58highlighting and raising this
34:01concern [clears throat]
34:02on this site of suspicious activity. Not
34:06known bad activity, nothing that we had
34:09seen before, but suspicious activity.
34:12File rights that didn't seem
34:15necessary or reasonable. Just general
34:19patterns that didn't seem
34:21human in the in the in the way that they
34:23were run. And so it was raised to our
34:26threat research team to look at. And
34:28this is one of those places where
34:30humans do still stay in the loop.
34:34>> Mhm.
34:35>> And Joe Bruno and the the
34:38the rest of the team, although I think
34:39on this one it was mostly Joe, Sal, T.J.
34:42Elkins. So, shout out to those guys.
34:46They really dug in, figured out what was
34:48happening, created new rules for our
34:52runtime engine that could protect
34:54against this, and new rules for our AV
34:57engine that could clean this, and also
35:01reported the vulnerability and so that
35:04the plug-in owner could
35:06fix it. But, we protected all of our
35:08users in the interim,
35:10but we also reported it so that they
35:11could fix it, got a, you know, CVE
35:14opened for it and and whatnot. And
35:17hopefully, that means that that fix
35:19ultimately rolled out to all of their
35:20customers rather than just the ones that
35:22overlapped with us.
35:24But, it's it's it's a different
35:26different level of of speed, and you
35:28have to proactively be looking at
35:31things, not reactively
35:34creating, you know, new
35:38file hashes like we did in in the past.
35:41>> Yeah. Do you have any statistics how
35:44many of these attacks happen? How often?
35:48>> I don't off the top of my head have
35:50statistics on how many of them happen. I
35:53will say that things have shifted
35:56significantly
35:58for us over the last handful of years
36:01from a number of things that were
36:04we were kind of cleaning up
36:06on the file system and whatnot to the
36:09number of things that we're identifying
36:12in runtime, the real-time
36:14view of the the processes that are
36:17happening to the point that now almost
36:21I want to say it's about 80% of our
36:23blocks are happening in that runtime
36:27layer. And that is an indicator to me
36:30that much more is happening
36:35in this sort of, I guess, being detected
36:38in this sort of behavioral way. This is
36:41bad behavior. This is abnormal behavior,
36:45even if it's not fully known. That's
36:47what that runtime engine really is is
36:49super powerful at. And so, seeing that
36:52massive climb in blocks on that side,
36:55it's because there's a lot more activity
36:58trying to do these kinds of exploits,
37:01find these kinds of vulnerabilities,
37:03and we're catching a lot more of it
37:06at that layer now.
37:07>> If I understand, so what what does mean
37:10that the runtime that 80% of all these
37:13attacks are catched on the runtime, what
37:15does it mean essentially?
37:16>> This is where we would catch more of the
37:19unknown, novel, new attacks, things that
37:22AI is trying that maybe it hasn't been
37:25seen before. That's what that runtime
37:28layer it it it sort of assesses the
37:30behavior of the request, assesses
37:33whether it's
37:35probably trying something bad and should
37:37be blocked,
37:39kind of confusing, doesn't seem right,
37:41should be raised to our threat research
37:43team, like this this WooCommerce one
37:45was, or is is clean normal behavior and
37:49we should let them pass. Um, and so,
37:51it's those those zero days, that novel
37:54stuff, things like this this WooCommerce
37:57plugin issue that uh had never been seen
38:00before, it's that runtime layer that
38:02finds and identifies that, which is why
38:04I think that that's such an indicator of
38:07all these new novel things being tried
38:09by AI, um, and being caught in that
38:11layer.
38:12>> Okay, Alan, thank you for the
38:14explanation and all the details on how
38:16are you guys doing? Again, you know, I I
38:18know, and again, this is not an
38:20advertisement. I know that Monarchs is
38:21doing great and it it is making a
38:24difference, so keep up the good work and
38:27yeah, good luck on the
38:29on on fighting the bad guys.
38:31>> Thank you for having me and we will.
38:34We'll we'll keep fighting the bad guys.

About this transcript

This page contains the full transcript of Malware That Shows AI a Clean Site (And Your Visitors Malware) | WHT S3E14 | Aaron Campbell - Monarx by WebhostingToday, generated from the public captions YouTube serves with the video. The transcript has 5,951 words across 945 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.