Stealthy WordPress Malware Uses Must-Use Plugin and Ethereum EtherHiding for Persistent Backdoor Access

A newly analyzed WordPress malware implant combines must-use plugin persistence, hidden administrator accounts, credential theft, cross-site propagation, and Ethereum-based EtherHiding to create an unusually resilient backdoor.

The malicious code masquerades as an automated health-check and reporting plugin, using plausible plugin metadata, an author name, and a repository link to reduce suspicion.

It is installed as a WordPress must-use, or MU, plugin typically under the wp-content/mu-plugins directory.

MU plugins load automatically with every request and cannot be turned off through WordPress’s normal Plugins page, making the location a valuable persistence layer for attackers.

Wordfence observed related samples using more than 4,000 distinct filenames, including legitimate-looking WordPress drop-ins such as advanced-cache.php and db.php, as well as theme functions.php files.

The filename, plugin name, author, and URI are therefore unreliable indicators on their own.

Instead of using easily recognized PHP obfuscation patterns such as eval(base64_decode()), the implant uses a custom substitution-based string decoder.

It stores sensitive strings such as WordPress hook names, database option keys, constants, paths, and function references in an encoded table and reconstructs them only at runtime.

The malware also manipulates WordPress filters to hide itself from the Must-Use Plugins view, the standard plugin inventory, update notifications, and Site Health checks.

This prevents administrators from seeing the implant through the interfaces normally used for routine site management.

Its persistence logic extends beyond file hiding. The malware creates a new administrator account with names constructed from prefixes such as admin_, adm_, administrator_, or backup_, followed by a random six-character suffix.

If an account already exists, it can reset its password instead, avoiding an increase in the visible user count. It then suppresses the rogue account from WordPress dashboard queries, REST API user listings, and administrator-count totals.

The implant stores a copy of its source code in the WordPress database and checks its own integrity early during WordPress execution.

WordPress API calls such as add_action() and get_option() are visible, but the values passed to them such as hook names, option names, constants, and file paths are hidden behind a custom string decoder.

If its file is deleted or falls below a size threshold, it restores itself from the saved database copy, backdates the file timestamp, and applies read-only permissions.

It can also reactivate itself by modifying the active_plugins option directly, bypassing the standard WordPress activation flow.

Wordfence said in a report shared with GBhackers, the malware is built to remain operational even after administrators attempt to remove it or disrupt its command-and-control infrastructure.

In shared-hosting environments, the malware searches common web-root locations and attempts to copy itself into other accessible WordPress installations, turning a single compromise into a potential multi-site incident.

Stealthy WordPress Malware

The implant captures plaintext passwords entered by legitimate administrator users by hooking WordPress’s authentication process.

The malware hooks WordPress’s authenticate filter, which fires after every login. The handler receives the authenticated user object, the username, and the plaintext password directly from WordPress.

It also collects active-plugin information, administrator session data, WooCommerce order data, and secrets exposed in wp-config.php, .env files, or Git configuration.

Targeted credentials include keys associated with Stripe, Braintree, Authorize.Net, and AWS.

The malware’s most notable feature is its use of EtherHiding. Rather than embedding a static command-and-control domain or IP address, it queries Ethereum smart contracts through public JSON-RPC gateways using the eth_call method.

The sample reportedly contains three contract addresses and 21 public RPC endpoints, selecting combinations at random.

The smart-contract response is decoded and decrypted to obtain a server encryption key and a current list of HTTP command servers.

This approach makes conventional disruption difficult: defenders may block an individual server or RPC gateway, but the malware can use another public gateway, another contract, or newly updated server addresses stored in the contract.

After contacting a recovered server, the implant sends encrypted reconnaissance and stolen data, then decrypts instructions returned by the operator.

Those instructions can update the malware, delete competing security plugins, strip content from installed plugin files, and inject attacker-controlled JavaScript into visitor-facing pages.

Wordfence released a detection signature on June 23, 2026, after quality assurance. Premium, Care, and Response customers received it immediately, while free users received the signature after the standard 30-day delay.

Site owners should inspect wp-content/mu-plugins, review database entries directly rather than relying only on dashboard views, audit all administrator accounts, rotate WordPress and payment-provider credentials, and treat WooCommerce, cloud, and API secrets as potentially compromised.

A clean rebuild from verified files and backups is preferable to deleting a single suspicious plugin, since this malware is designed to restore itself and spread across accessible sites.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC