Loading story…
Attackers concealed a PHP web shell inside whitespace appended to a seemingly benign license.php file, using a steganographic technique that encoded the payload in tabs and spaces after legitimate-looking text from the GNU GPL license. The visible PHP code then read its own file, extracted data after the final semicolon, converted whitespace into binary, and applied multiple decoding layers including gzdecode, str_rot13, and base64_decode to rebuild and execute the hidden malware.
The recovered payload was a large web shell capable of file and database operations, information theft, file infection, brute-force activity, and use as a server console or anonymizer on compromised websites. Investigators also found uploader backdoors used to create the fake license.php files and additional malicious changes to .htaccess and index.php, while noting that the whitespace-decoding routine appeared to be adapted from a public proof of concept previously published on Habr.ru.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
According to the analysis, a 2019 Habr.ru article published a proof of concept for whitespace steganography, and the malware's decoder appears to match that technique without modification.
The malware analysis states that the whitespace-only encoding method used by the PHP malware was originally inspired by a 2011 article about encoding data using only tabs and spaces.
Sucuri documented how the visible license.php code read its own file, decoded tab-and-space data appended after the final semicolon, and reconstructed a 74 KB web shell through base64, ROT13, and gzip decoding layers. The analysis also noted fallback execution via a blank-named temporary file and described the web shell's capabilities, including file and database management, information theft, brute-force activity, and anonymization.
Investigators found attackers had hidden a PHP web shell inside whitespace appended to a fake system/license.php file on compromised websites. Additional uploader backdoors were also used to create fake license.php files and inject malicious code into .htaccess and index.php files.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A PHP web-hacking challenge demonstrated how attacker-controlled input written into a generated PHP configuration file can become executable code. The application removed double quotes, single quotes, and semicolons from a `data` parameter, but then embedded the value in a double-quoted PHP string; PHP variable-interpolation syntax could still invoke attacker-controlled functions when the generated file was requested. The technique enabled PHP code execution and inspection of runtime configuration. A broad `disable_functions` policy did not prevent disclosure of a protected `key.php` file because `gzfile` remained available, illustrating that partial PHP function blacklists and dynamically generated executable configuration files do not provide reliable isolation.
Sep 3, 2026
GoDaddy researchers uncovered a malware campaign affecting nearly 2,000 WordPress sites that uses **Steam Community profile comments** as a covert command-and-control channel. The malware stores payload data in benign-looking comments with invisible Unicode characters, decodes that content when a page loads, and builds a URL to fetch malicious JavaScript from `hello-mywordl[.]info`. The retrieved code is disguised as legitimate JavaScript libraries and injected into WordPress frontend pages, allowing attackers to deliver malicious content while blending in with normal site behavior. Researchers said the campaign also installs a final-stage **PHP backdoor** that enables remote code execution through crafted `POST` requests and an authentication cookie. The initial intrusion vector remains unknown, but possible paths include stolen WordPress admin or FTP/SFTP credentials, vulnerable themes or plugins, or a supply-chain compromise. The malware uses string obfuscation, randomized function names, fake disabled logging, and abuse of standard WordPress APIs to evade detection, and GoDaddy warned that incomplete remediation can let attackers regain access unless affected sites are restored from a known-good backup.
Jun 29, 2026
Researchers reported mass compromises of legitimate WordPress sites that use injected or rogue must-use plugins to deliver ClickFix-based malware chains. The malicious JavaScript registers browser Service Workers that can persist beyond site cleanup, remove Content Security Policy headers, and inject further scripts. Payload-stage code is retrieved through **EtherHiding** from mutable smart contracts—reported on Ethereum Sepolia, Ethereum mainnet, and Base—using encrypted browser payloads and fake reCAPTCHA lures to steer victims into executing malicious Windows actions. One observed chain downloads a Python-based RAT masquerading as `IntelSoftwareUpdaterV8.exe`, creates a hidden scheduled task, and uses UDP/53 traffic resembling Microsoft DNS for command-and-control. A separate nine-layer chain delivers the **Amatera** password stealer through an MP3/HTA polyglot, fileless AMSI-bypassing PowerShell, the Emmenhtal loader, reflective in-memory execution, steganographic payload concealment, and DNS-over-HTTPS. Organizations operating WordPress sites should investigate for unauthorized plugins and injected JavaScript, explicitly unregister malicious Service Workers during remediation, block identified infrastructure, and monitor the implicated smart contracts for payload rotation.
Aug 27, 2026