Sucuri researchers have spotted a new trend, threat actors are injecting the e-skimmers into WordPress plugin files, instead of ‘wp-admin’ and ‘wp-includes’ core directories which are more monitored.