Title: Malware? Last modified: August 30, 2016 --- # Malware? * Resolved [acurran](https://wordpress.org/support/users/acurran/) * (@acurran) * [10 years, 10 months ago](https://wordpress.org/support/topic/malware-45/) * I noticed suspicious code on one of the websites that I manage. After investigating further I discovered that the suspicious code appears only when Fancybox for WordPress (v. 3.0.6) is activated. Below is the suspicious code. Is this plugin infected with malware? *

* [https://wordpress.org/plugins/fancybox-for-wordpress/](https://wordpress.org/plugins/fancybox-for-wordpress/) Viewing 3 replies - 1 through 3 (of 3 total) * Thread Starter [acurran](https://wordpress.org/support/users/acurran/) * (@acurran) * [10 years, 10 months ago](https://wordpress.org/support/topic/malware-45/#post-6375953) * upon further investigation I’ve found that the suspicious code is in the options. The mfbfw option contains the malware code and injects into the Fancybox for WP header output. Anyone have any ideas how this compromise could have happened? Here is what was in the mfbfw option: * a:3:{s:10:”extraCalls”;s:1:” “;s:13:”transitionOut”;s:762:””,’centerOnScroll’: false});})