Most of these attacks succeed because of known vulnerabilities in plugins or themes. Automate updates where possible, or at least set a weekly update reminder.
What are the key features of the injectserver.com app that ... - BYDFi
Once inside, the attackers would modify core files (e.g., footer.php , index.html , or checkout.js ) to include a remote script tag pointing to www.injectserver[.]com/inject.js .