Loading story…
GoDaddy researchers uncovered a malware campaign affecting nearly 2,000 WordPress sites that uses Steam Community profile comments as a covert command-and-control channel. The malware stores payload data in benign-looking comments with invisible Unicode characters, decodes that content when a page loads, and builds a URL to fetch malicious JavaScript from hello-mywordl[.]info. The retrieved code is disguised as legitimate JavaScript libraries and injected into WordPress frontend pages, allowing attackers to deliver malicious content while blending in with normal site behavior.
Researchers said the campaign also installs a final-stage PHP backdoor that enables remote code execution through crafted POST requests and an authentication cookie. The initial intrusion vector remains unknown, but possible paths include stolen WordPress admin or FTP/SFTP credentials, vulnerable themes or plugins, or a supply-chain compromise. The malware uses string obfuscation, randomized function names, fake disabled logging, and abuse of standard WordPress APIs to evade detection, and GoDaddy warned that incomplete remediation can let attackers regain access unless affected sites are restored from a known-good backup.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
GoDaddy Security said it first detected the WordPress malware campaign in July 2025. The campaign later grew to affect about 1,980 WordPress sites and used Steam Community profile comments with invisible Unicode characters to conceal command-and-control data.
GoDaddy researchers reported a malware campaign affecting nearly 2,000 WordPress websites that abuses Steam Community profile comments as a covert command-and-control channel. The malware decodes payload data hidden with invisible Unicode characters, retrieves malicious JavaScript from hello-mywordl[.]info, and deploys a PHP backdoor enabling remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
8 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcexakep.ru
Open sourcesecurityonline.info
Open sourcehackread.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcegodaddy.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gootloader operators continued to refresh their command-and-control infrastructure while maintaining a malware delivery chain built on compromised WordPress sites, fake forum pages, and malicious ZIP archives containing obfuscated JavaScript. Reporting shows the actor shifted key domains and IPs over time—from `my-game.biz`, `inerino.co.za`, and `za-co-za.co.za` to `new-game[.]me`, `luckyserver777.co.za`, and most recently `hotheads.co.za` at `91.215.85.21`—with infected systems observed contacting the newest server shortly after the change. Researchers also found malicious PHP injected into WordPress files including `xmlrpc.php`, `functions.php`, `404.php`, and upload paths, with additional logic hidden in the WordPress database to collect victim metadata and relay commands. Hands-on analysis confirmed the malware remains operational despite claims it was broken: a reproduced infection on Windows 11 showed file writes, scheduled-task persistence, PowerShell execution, and outbound beaconing that encoded host-enumeration data in HTTP Cookie headers. Earlier intrusion reporting tied Gootloader to a more severe post-compromise chain in which initial JavaScript execution led to PowerShell backdoors, Cobalt Strike deployment through DLL hijacking, SystemBC use, lateral movement with remote services and PsExec, and attempts to disable Microsoft Defender. The rapid domain rotation, updated JavaScript hiding techniques, and possible dependence on newer PowerShell behavior indicate an active effort to evade detection and preserve access to Windows environments.
Aug 15, 2026
Researchers reported mass compromises of legitimate WordPress sites that use injected or rogue must-use plugins to deliver ClickFix-based malware chains. The malicious JavaScript registers browser Service Workers that can persist beyond site cleanup, remove Content Security Policy headers, and inject further scripts. Payload-stage code is retrieved through **EtherHiding** from mutable smart contracts—reported on Ethereum Sepolia, Ethereum mainnet, and Base—using encrypted browser payloads and fake reCAPTCHA lures to steer victims into executing malicious Windows actions. One observed chain downloads a Python-based RAT masquerading as `IntelSoftwareUpdaterV8.exe`, creates a hidden scheduled task, and uses UDP/53 traffic resembling Microsoft DNS for command-and-control. A separate nine-layer chain delivers the **Amatera** password stealer through an MP3/HTA polyglot, fileless AMSI-bypassing PowerShell, the Emmenhtal loader, reflective in-memory execution, steganographic payload concealment, and DNS-over-HTTPS. Organizations operating WordPress sites should investigate for unauthorized plugins and injected JavaScript, explicitly unregister malicious Service Workers during remediation, block identified infrastructure, and monitor the implicated smart contracts for payload rotation.
Aug 27, 2026
Researchers reported attackers are hiding malicious PHP code in WordPress sites’ `mu-plugins` directory, a location that loads plugins automatically and is often overlooked because entries do not appear in the standard administrative plugin view. In one observed intrusion, a file named `wp-index.php` in `wp-content/mu-plugins/` fetched a second-stage payload from a `ROT13`-obfuscated URL, giving the attacker persistent access and the ability to execute remote PHP code on the compromised server. Additional infections linked to the same technique included redirects to fake update pages, website defacement or content replacement, and webshell deployment. The reported impact ranges from remote code execution and privilege escalation to denial of service and full site compromise, prompting defenders to audit the `mu-plugins` folder, review indicators of compromise, keep WordPress components updated, enforce proper file permissions, and disable in-dashboard file editing in `wp-config.php`.
Aug 14, 2026