Loading story…
The SC WordPress malware family maintains a self-healing backdoor mesh that can restore deleted components within seconds. It distributes redundant payloads among WordPress core and theme files, early-loading PHP configuration, fake duplicate plugins and drop-ins, database records, scheduled tasks, recovery archives, and System V shared memory. Remaining components can recreate removed ones, while hidden privileged administrator accounts, forged authentication cookies, and stolen administrator-session tokens preserve attacker access. The initial access vector and number of affected sites remain unknown.
SC retrieves command-and-control instructions through public Ethereum RPC gateways and smart-contract method selectors, enabling operators to rotate infrastructure and deliver replacement PHP payloads, browser-side JavaScript, or commands to remove security plugins. The malware can collect site reconnaissance data, disable defenses, and inject payment-skimming JavaScript into online stores. Defenders should first prevent malicious code execution, then coordinate removal of filesystem artifacts, database payloads and triggers, shared-memory content, cron jobs, hidden accounts, and recovery mechanisms; organizations should also rotate credentials and remediate the original intrusion path.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Sucuri analysts identified the SC malware during website-cleanup work and documented its layered persistence, which can restore removed components from files, databases, scheduled tasks, and System V shared memory. The initial compromise vector and number of affected sites were not established.
Sucuri published an analysis of the SC WordPress backdoor family, detailing its redundant loaders and payload stores, Ethereum RPC-based command-and-control mechanism, administrator-account concealment, and recommended coordinated remediation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceblog.sucuri.net
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported mass compromises of legitimate WordPress sites that use injected or rogue must-use plugins to deliver ClickFix-based malware chains. The malicious JavaScript registers browser Service Workers that can persist beyond site cleanup, remove Content Security Policy headers, and inject further scripts. Payload-stage code is retrieved through **EtherHiding** from mutable smart contracts—reported on Ethereum Sepolia, Ethereum mainnet, and Base—using encrypted browser payloads and fake reCAPTCHA lures to steer victims into executing malicious Windows actions. One observed chain downloads a Python-based RAT masquerading as `IntelSoftwareUpdaterV8.exe`, creates a hidden scheduled task, and uses UDP/53 traffic resembling Microsoft DNS for command-and-control. A separate nine-layer chain delivers the **Amatera** password stealer through an MP3/HTA polyglot, fileless AMSI-bypassing PowerShell, the Emmenhtal loader, reflective in-memory execution, steganographic payload concealment, and DNS-over-HTTPS. Organizations operating WordPress sites should investigate for unauthorized plugins and injected JavaScript, explicitly unregister malicious Service Workers during remediation, block identified infrastructure, and monitor the implicated smart contracts for payload rotation.
Aug 27, 2026
GoDaddy researchers uncovered a malware campaign affecting nearly 2,000 WordPress sites that uses **Steam Community profile comments** as a covert command-and-control channel. The malware stores payload data in benign-looking comments with invisible Unicode characters, decodes that content when a page loads, and builds a URL to fetch malicious JavaScript from `hello-mywordl[.]info`. The retrieved code is disguised as legitimate JavaScript libraries and injected into WordPress frontend pages, allowing attackers to deliver malicious content while blending in with normal site behavior. Researchers said the campaign also installs a final-stage **PHP backdoor** that enables remote code execution through crafted `POST` requests and an authentication cookie. The initial intrusion vector remains unknown, but possible paths include stolen WordPress admin or FTP/SFTP credentials, vulnerable themes or plugins, or a supply-chain compromise. The malware uses string obfuscation, randomized function names, fake disabled logging, and abuse of standard WordPress APIs to evade detection, and GoDaddy warned that incomplete remediation can let attackers regain access unless affected sites are restored from a known-good backup.
Jun 29, 2026
eSentire reported a resurging malware operation dubbed **Resident** targeting manufacturing, commercial, and healthcare organizations. The campaign, active since late 2022 and likely run by native Russian-speaking operators, used phishing emails and drive-by downloads from compromised WordPress sites to deliver JavaScript payloads that installed MSI packages, VBS scripts, screenshot utilities, and a **Node.js-based backdoor**. Across multiple incidents, the attackers also deployed custom Resident backdoors, **Cobalt Strike** loaders and beacons, reconnaissance tools, and persistence mechanisms to maintain access. The intrusion chain relied on repeated MSI retrieval, host profiling, screenshot capture, command execution, and scheduled-task or startup persistence to support follow-on activity after initial compromise. In one case, the operators attempted to deploy the **Rhadamanthys** stealer, indicating an interest in credential and data theft alongside broader post-compromise operations. The tooling and workflow described point to a flexible access-and-surveillance campaign designed to establish footholds, collect system intelligence, and enable additional malicious actions on victim networks.
Aug 15, 2026