Sign1 affiliate fraud kit

Sign1 is a script planted in WordPress custom HTML widgets and custom code plugins. It lets site owners and direct visitors through and sends visitors from Google and Bing to a remote redirect script. We have matched it on 4 sites since 9 October.

Research by Kirk

Sign1 in numbers

Since 9 October, the first Sign1 match in our records, counted on 1 November 2026. How we count.

Sites with Sign1 code	4
Sites with a match in the last 30 days	4

A known injector, still running

Sucuri named Sign1 in March 2024 after finding it on more than 39,000 WordPress sites. It reported that the script sent visitors to scam sites and pop-up ads and that its URLs changed every 10 minutes (BleepingComputer). The code we match is the same injector, still running in October 2026.

On the sites we captured, Sign1 sits in a custom CSS and JS plugin block, or in footer widgets with ids such as block-111 and custom_html-114. Both are saved through the WordPress admin, so the theme and plugin files stay unchanged.

Only search visitors are sent on

The script tag carries a sign1 attribute. The script decodes it from Base64 into the host it loads from, then removes the attribute from the page. Before it does anything else it checks two gates:

a cookie named search_active
the referrer, which must contain google. or bing.

A visitor who types the address or follows a bookmark, as a site owner does, sees the normal site. A visitor from a search result gets a script loaded from the decoded host, with the page address, the referrer and the browser language attached as u, r and l. That script decides where the visitor goes.

What we see

Month	New sites
September	0
October	4
November so far	0

Checking a WordPress site

Open the site from a Google search result in a private window and watch the network log. In the admin, check:

every Custom HTML widget, footer widget area and block for a script with a sign1 attribute
the code saved in custom CSS and JS plugins
the database for sign1= and search_active, in wp_options and wp_posts, and wp-content/uploads for saved custom code files

Remove the script, purge page and CDN caches, and review who has administrator access. Change every administrator password; Sucuri traced one infection to a password guessed by brute force.