Malwarehigh
Logged-in WordPress admins tricked into installing hidden PHP backdoors
Original title: Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors
AI summary · x-ai/grok-4.7Summaries by Vani AI
Securonix calls the chain TRUST#GRAFT; a fake Cloudflare screen uploads wm.zip and hides it as a must-use plugin.
A JavaScript loader waits for a signed-in WordPress administrator to visit a compromised page, then uses that browser session to install a plugin. The plugin, Web Media Optimizer 2.1, injects remote JavaScript, disables TLS certificate checks, and can set an admin cookie through a hardcoded token. It copies itself to wp-content/mu-plugins/wmedia-recovery.php, which WordPress loads automatically and hides from the Plugins page. Securonix has not confirmed how the first script arrived.
Unconfirmed: How the first script reached compromised pages is unconfirmed, and the 1.2 million figure refers to a related example.
Key facts
- The script reads a WordPress nonce from the plugin upload page.
- The ZIP is named wm.zip and is activated through the normal plugin endpoint.
- Securonix lists loaders on gerlace.com, vtevens.icu and caapman.me.
- Removing only the visible plugin leaves the mu-plugins copy in place.
Security assessment · AI, from the article
Impact: Hidden PHP backdoor and forged administrator login cookie
| Product | Affected |
|---|---|
| WordPress | — |
What to do
- 1.Use a separate browser profile for wp-admin and sign out after suspicious activity.
- 2.Rotate administrator credentials and limit plugin upload rights.
- 3.Remove Web Media Optimizer, wmedia-recovery.php, and leftover remote scripts.
- Products
- WordPressWeb Media Optimizer
- Malware
- TRUST#GRAFT
- Organizations
- Securonix
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | caapman.me | vaScript loader vtevens[.]icu/x9bpnmck.js JavaScript loader caapman[.]me/cse3g1jd.js JavaScript loader http://caapman [.]me/9l56j7 |
| domain | gerlace.com | ors of compromise (IoCs):- Type Indicator JavaScript loader gerlace[.]com/0k2blyny.js JavaScript loader gerlace[.]com/j0ghlty4.js J |
| domain | nutmann.club | .php C2 domains caapman[.]me, vtevens[.]icu, gerlace[.]com, nutmann[.]club, okuneva[.]sbs, vilialobos[.]lol C2 API paths /api/v1/8e4 |
| domain | okuneva.sbs | caapman[.]me, vtevens[.]icu, gerlace[.]com, nutmann[.]club, okuneva[.]sbs, vilialobos[.]lol C2 API paths /api/v1/8e4c615, /api/v1/f |
| domain | vilialobos.lol | stage ZIP https://okuneva [.]sbs/p/wm.zip Controller source vilialobos[.]lol/ads.php C2 domains caapman[.]me, vtevens[.]icu, gerlace[. |
| domain | vtevens.icu | vaScript loader gerlace[.]com/j0ghlty4.js JavaScript loader vtevens[.]icu/50w2ouvx.js JavaScript loader vtevens[.]icu/x9bpnmck.js J |
| sha256 | 07955dcb5f4f80c90ede398879589f2e369eb2d84c4975d3c8adf08433783409 | f49a2f963a6126b917e1bc653890f8c79738c981d JavaScript SHA256 07955dcb5f4f80c90ede398879589f2e369eb2d84c4975d3c8adf08433783409 PHP SHA256 (wmedia-recovery.php) 86d775c2d5cb459541cd2b0b96 |
| sha256 | 0a3cb24e0d0c05b544a3e32affe3ea8a4ed87c0cc90e918c10b94d3b849d76fa | 4491b1a0f8734626b5328fca9723d942b7128bc9c JavaScript SHA256 0a3cb24e0d0c05b544a3e32affe3ea8a4ed87c0cc90e918c10b94d3b849d76fa JavaScript SHA256 16f73adce28e3a33e98035a19721819ddac9cda13 |
| sha256 | 16f73adce28e3a33e98035a19721819ddac9cda130e6f1c337db6f8d8c2f95c6 | affe3ea8a4ed87c0cc90e918c10b94d3b849d76fa JavaScript SHA256 16f73adce28e3a33e98035a19721819ddac9cda130e6f1c337db6f8d8c2f95c6 JavaScript SHA256 f110e20dce8361a31332faba49e29e6afd54f8bc4 |
| sha256 | 19d9335e66d9d519c9068994491b1a0f8734626b5328fca9723d942b7128bc9c | e81929c, /api/v1/6a38418, /api/v1/76584c1 JavaScript SHA256 19d9335e66d9d519c9068994491b1a0f8734626b5328fca9723d942b7128bc9c JavaScript SHA256 0a3cb24e0d0c05b544a3e32affe3ea8a4ed87c0cc |
| sha256 | 2747316171bb2816b68db308162b40a47c6ddf82779d5f460a194921eb60f32c | bd6efc7e947c1822e95c87f9a5b5288b4331400c8 JavaScript SHA256 2747316171bb2816b68db308162b40a47c6ddf82779d5f460a194921eb60f32c JavaScript SHA256 eb5a6c895d24fd08e3bbd74d7a0ea02600d3b7574 |
| sha256 | 2cac894bf2cef2232247927e18acd35280065b576c5fa030b5fbad666db0afcc | d170f27f10fd6d0a4e606c5b4f6e916ddc54924ed JavaScript SHA256 2cac894bf2cef2232247927e18acd35280065b576c5fa030b5fbad666db0afcc JavaScript SHA256 eeb182444019802abb34668bd6efc7e947c1822e9 |
| sha256 | 2dfa9e708fdb92e5d36080065f978e33a692c0fe813a75be9c7cdff03be51b6e | 7fac65ce20c60e483c71c9f7e108d5ad0bd564 PHP SHA256 (ads.php) 2dfa9e708fdb92e5d36080065f978e33a692c0fe813a75be9c7cdff03be51b6e ZIP SHA256 (wm.zip) 9215d17e5138cee498bb529e69b1cc726730513 |
| sha256 | 2fa9c207981e05141162b9c5cf62a86bdc6593b3a6861968e4df58f49c47da0d | 7e475c3131f4005be59468a59905fc289e005806d JavaScript SHA256 2fa9c207981e05141162b9c5cf62a86bdc6593b3a6861968e4df58f49c47da0d JavaScript SHA256 e98949a8370c5c3356a8e97f49a2f963a6126b917 |
| sha256 | 3b79b342a580dd09a5e3f907e475c3131f4005be59468a59905fc289e005806d | d7a0ea02600d3b7574b9761efb2876b671e8ddd39 JavaScript SHA256 3b79b342a580dd09a5e3f907e475c3131f4005be59468a59905fc289e005806d JavaScript SHA256 2fa9c207981e05141162b9c5cf62a86bdc6593b3a |
| sha256 | 4659d9648275113f7f95735d170f27f10fd6d0a4e606c5b4f6e916ddc54924ed | f321ec2c0a677a0374e02d47f95d43196fc4cac0a JavaScript SHA256 4659d9648275113f7f95735d170f27f10fd6d0a4e606c5b4f6e916ddc54924ed JavaScript SHA256 2cac894bf2cef2232247927e18acd35280065b576 |
| sha256 | 765525c4fabd01383ca3dd330dd4f4fbc931bea0724c12f553df41b48a96ca82 | f9436bd2da429e05bd96d39fafe1c42fbcdfcd4e7 JavaScript SHA256 765525c4fabd01383ca3dd330dd4f4fbc931bea0724c12f553df41b48a96ca82 JavaScript SHA256 804349f8f087588b057e942f321ec2c0a677a0374 |
| sha256 | 804349f8f087588b057e942f321ec2c0a677a0374e02d47f95d43196fc4cac0a | 30dd4f4fbc931bea0724c12f553df41b48a96ca82 JavaScript SHA256 804349f8f087588b057e942f321ec2c0a677a0374e02d47f95d43196fc4cac0a JavaScript SHA256 4659d9648275113f7f95735d170f27f10fd6d0a4e |
| sha256 | 85515e25894cace49286581f9436bd2da429e05bd96d39fafe1c42fbcdfcd4e7 | a49e29e6afd54f8bc4913841f9bdad3cbb66c14e3 JavaScript SHA256 85515e25894cace49286581f9436bd2da429e05bd96d39fafe1c42fbcdfcd4e7 JavaScript SHA256 765525c4fabd01383ca3dd330dd4f4fbc931bea07 |
| sha256 | 86d775c2d5cb459541cd2b0b967fac65ce20c60e483c71c9f7e108d5ad0bd564 | d84c4975d3c8adf08433783409 PHP SHA256 (wmedia-recovery.php) 86d775c2d5cb459541cd2b0b967fac65ce20c60e483c71c9f7e108d5ad0bd564 PHP SHA256 (ads.php) 2dfa9e708fdb92e5d36080065f978e33a692c0 |
| sha256 | 9215d17e5138cee498bb529e69b1cc7267305136535025e9b49fe173cf648720 | f978e33a692c0fe813a75be9c7cdff03be51b6e ZIP SHA256 (wm.zip) 9215d17e5138cee498bb529e69b1cc7267305136535025e9b49fe173cf648720 Plugin name Web Media Optimizer 2.1 Persistence path wp-con |
| sha256 | e98949a8370c5c3356a8e97f49a2f963a6126b917e1bc653890f8c79738c981d | 5cf62a86bdc6593b3a6861968e4df58f49c47da0d JavaScript SHA256 e98949a8370c5c3356a8e97f49a2f963a6126b917e1bc653890f8c79738c981d JavaScript SHA256 07955dcb5f4f80c90ede398879589f2e369eb2d84 |
| sha256 | eb5a6c895d24fd08e3bbd74d7a0ea02600d3b7574b9761efb2876b671e8ddd39 | 8162b40a47c6ddf82779d5f460a194921eb60f32c JavaScript SHA256 eb5a6c895d24fd08e3bbd74d7a0ea02600d3b7574b9761efb2876b671e8ddd39 JavaScript SHA256 3b79b342a580dd09a5e3f907e475c3131f4005be5 |
| sha256 | eeb182444019802abb34668bd6efc7e947c1822e95c87f9a5b5288b4331400c8 | e18acd35280065b576c5fa030b5fbad666db0afcc JavaScript SHA256 eeb182444019802abb34668bd6efc7e947c1822e95c87f9a5b5288b4331400c8 JavaScript SHA256 2747316171bb2816b68db308162b40a47c6ddf827 |
| sha256 | f110e20dce8361a31332faba49e29e6afd54f8bc4913841f9bdad3cbb66c14e3 | 19721819ddac9cda130e6f1c337db6f8d8c2f95c6 JavaScript SHA256 f110e20dce8361a31332faba49e29e6afd54f8bc4913841f9bdad3cbb66c14e3 JavaScript SHA256 85515e25894cace49286581f9436bd2da429e05bd |
From the original article
4 min read at cybersecuritynews.com
WordPress administrators often keep their dashboard open in the same browser they use for everyday browsing. A new attack chain shows why that habit is risky. Researchers have documented a JavaScript loader that waits for a signed-in administrator to visit a compromised page, then uses that browser’s trusted session to install a hidden PHP backdoor […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.