Active malware campaign uses thousands of WordPress sites to infect visitors (arstechnica.com)