Question Skript from configpromo.online

[jhuedder]

Hi there,

for a couple of days I find a script named config.js from configpromo.online inserted into the code of several of my clients websites. The websites are Joomla-, Wordpress-, Shopware- and selfmade PHP-Sites which only have in common that hey are hosted on servers running Plesk (Onyx and Obsidian on Ubuntu 16 and 18 LTS). I already searched the logfiles but didn't find any clue. Does anyone here have the same trouble and a hint for me?

Thanks, Jörg