My webhost notified me they got a complaint from bank of america that one of my accounts under my reseller (WHM) account was compromised by a phisher. Once the host unsuspended my account I tried to find out how the account was compromised but cannot figure it out.
- My account didn't have any scripts running, just static .html files.
- All passwords are quite strong - 8 characters auto generated with lower case, upper case, numbers and special characters mixed.
- Client computer is wired to router and has up to date anti-virus, anti-spyware, firewall and hasn't been infected ever before.
- SFTP is not supportted by webhost with shared SSL certificate therefore uploads are done with filezilla as normal
I'm assuming that if the phisher somehow captured passwords then they would have done more damage, so my current line of thinking is some sort of vulnerability in cpanel/.htaccess etc?
The phisher made a subdomain and folder with a fake site which captured banking details and emailed it to themselves.
My question is this, how did the phisher compromise the account to upload his files? (or what possible weaknesses could he exploit)