Stealthy WordPress Malware Uses Must-Use Plugin and Ethereum EtherHiding for Persistent Backdoor Access
Wordfence details a WordPress must-use plugin backdoor that steals credentials and hides C2 on Ethereum.
Wordfence analyzed a WordPress backdoor installed as a must-use plugin that hides from dashboards, creates or resets concealed administrator accounts, and restores itself from a database copy if deleted. It hooks authentication to capture plaintext administrator passwords and collects WooCommerce data plus secrets from wp-config.php, .env, and Git configuration, including Stripe, Braintree, Authorize.Net, and AWS keys. Command-and-control addresses are obtained through EtherHiding by calling Ethereum smart contracts over 21 public JSON-RPC endpoints. The implant can spread to other WordPress sites on shared hosts and inject JavaScript. Wordfence released a detection signature on June 23, 2026, after observing samples under more than 4,000 filenames.
- Must-use plugin hides from the admin UI and restores itself from the database
- Creates or password-resets hidden administrator accounts
- Captures plaintext admin passwords and payment, cloud, and API secrets
- Fetches command servers from Ethereum contracts over public RPC gateways
- Can copy itself into other WordPress sites on the same host
- ATT&CK
- T1136.001 Create Account: Local AccountT1098 Account ManipulationT1056.003 Web Portal CaptureT1552.001 Unsecured Credentials: Credentials In FilesT1102.001 Dead Drop Resolver
- Products
- WordPressWooCommerce
- Organizations
- Wordfence
From the original article
4 min read at gbhackers.com
A newly analyzed WordPress malware implant combines must-use plugin persistence, hidden administrator accounts, credential theft, cross-site propagation, and Ethereum-based EtherHiding to create an unusually resilient backdoor. The malicious code masquerades as an automated health-check and reporting plugin, using plausible plugin metadata, an author name, and a repository link to reduce suspicion.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.