Loading story…
Researchers identified a WordPress malware operation that injects malicious JavaScript into sites, fingerprints visitors, and presents a counterfeit Cloudflare verification overlay to hijack active administrator sessions. Using same-origin requests and stolen browser-held tokens, the loader silently installs and activates a backdoored plugin called Web Media Optimizer, establishing a hardcoded administrator-login path and persistent copies in the mu-plugins directory.
The implant hides itself and rogue administrator accounts from the WordPress dashboard and REST API, can restore itself after removal, and remotely injects scripts, removes plugins, or alters plugin content. It steals administrator credentials and sessions, WooCommerce order data, and secrets for Stripe, Braintree, Authorize.Net, and AWS; its EtherHiding mechanism retrieves encrypted C2 details from Ethereum smart contracts via public RPC services. Defenders should inspect mu-plugins and wp_options entries beginning with _wm2_; reported delivery domains used IP 46.29.26.20 and nsdrive.net nameservers, although shared infrastructure alone does not establish attribution.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
A detection signature for the malicious WordPress must-use plugin was released on June 23, 2026.
A sophisticated malicious WordPress must-use plugin was discovered during a site cleanup in mid-June 2026. The implant concealed itself and rogue administrator accounts, maintained persistence, stole credentials and data, and used Ethereum-based EtherHiding to obtain command-and-control information.
Investigators identified a malicious JavaScript loader platform that abuses active WordPress administrator sessions to upload and activate a backdoored "Web Media Optimizer" plugin. The installed plugin hides from normal plugin listings, creates a persistent must-use copy, provides a hardcoded administrator-login mechanism, and injects remotely supplied scripts into compromised sites.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported attackers are hiding malicious PHP code in WordPress sites’ `mu-plugins` directory, a location that loads plugins automatically and is often overlooked because entries do not appear in the standard administrative plugin view. In one observed intrusion, a file named `wp-index.php` in `wp-content/mu-plugins/` fetched a second-stage payload from a `ROT13`-obfuscated URL, giving the attacker persistent access and the ability to execute remote PHP code on the compromised server. Additional infections linked to the same technique included redirects to fake update pages, website defacement or content replacement, and webshell deployment. The reported impact ranges from remote code execution and privilege escalation to denial of service and full site compromise, prompting defenders to audit the `mu-plugins` folder, review indicators of compromise, keep WordPress components updated, enforce proper file permissions, and disable in-dashboard file editing in `wp-config.php`.
Aug 14, 2026
Attackers tampered with JavaScript served from **Awesome Motive** infrastructure for the widely used WordPress plugins **OptinMonster**, **TrustPulse**, and **PushEngage**, triggering a supply-chain compromise that Sansec said exposed more than **1.2 million sites**. The malicious code activated only when a logged-in WordPress administrator visited an affected site, then stole authentication data, exfiltrated site details to the typosquatted domain `tidio.cc`, created rogue administrator accounts, and deployed a stealth plugin designed to hide from normal WordPress administrative views. Researchers said the hidden plugin provided **unauthenticated remote code execution** through a web shell and an `eval`-style endpoint, effectively giving attackers arbitrary PHP execution on compromised servers. Sansec verified malicious code in OptinMonster and TrustPulse CDN files beginning June 12 and said those paths were later cleaned, while some PushEngage CDN edges continued serving infected code until June 14; the exact initial compromise point remains unknown, but the distribution path ran through Awesome Motive-operated domains via BunnyNet CDN. Defenders were urged to treat any affected site with an administrator logged in during the exposure window as fully compromised, remove rogue users, search for hidden plugin directories, and rotate all administrator credentials and secrets.
Aug 11, 2026
Researchers reported mass compromises of legitimate WordPress sites that use injected or rogue must-use plugins to deliver ClickFix-based malware chains. The malicious JavaScript registers browser Service Workers that can persist beyond site cleanup, remove Content Security Policy headers, and inject further scripts. Payload-stage code is retrieved through **EtherHiding** from mutable smart contracts—reported on Ethereum Sepolia, Ethereum mainnet, and Base—using encrypted browser payloads and fake reCAPTCHA lures to steer victims into executing malicious Windows actions. One observed chain downloads a Python-based RAT masquerading as `IntelSoftwareUpdaterV8.exe`, creates a hidden scheduled task, and uses UDP/53 traffic resembling Microsoft DNS for command-and-control. A separate nine-layer chain delivers the **Amatera** password stealer through an MP3/HTA polyglot, fileless AMSI-bypassing PowerShell, the Emmenhtal loader, reflective in-memory execution, steganographic payload concealment, and DNS-over-HTTPS. Organizations operating WordPress sites should investigate for unauthorized plugins and injected JavaScript, explicitly unregister malicious Service Workers during remediation, block identified infrastructure, and monitor the implicated smart contracts for payload rotation.
Aug 27, 2026