Logged-in WordPress admins tricked into installing hidden PHP backdoors
Securonix calls the chain TRUST#GRAFT; a fake Cloudflare screen uploads wm.zip and hides it as a must-use plugin.
66
Product
Web Media Optimizer
- Mentions · 7d0
- Mentions · 30d2
- All mentions3
- First seenSep 17, 2026
- Last mentioned15d ago
Timeline
3 articles · newest firstTRUST#GRAFT uses logged-in WordPress admins to install a PHP backdoor
The chain uploads wm.zip as Web Media Optimizer and copies itself to mu-plugins so deleting the visible plugin leaves it loaded.
62
Brevo supply-chain attack injected ClickFix scripts on customer sites
Attackers used a stolen Cloudflare API key to inject ClickFix malware-delivery scripts into Brevo sites and customer-embedded scripts for five hours.
80
Appears with
- WordPressproduct · 2
- TRUST#GRAFTmalware · 2
- Securonixorganization · 2
- Cloudflarevendor · 1
- Brevo Conversationsproduct · 1
- Trezorvictim · 1
- BleepingComputervendor · 1
- Brevovendor · 1
- wmedia-recovery.phpmalware · 1
- Sansecvendor · 1
- Web Media Optimizermalware · 1
- Trezororganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.