WordPress plugins are under active attack, a new banking trojan is spreading, and phishing and brute-force attacks continue unabated.