TRUST#GRAFT uses logged-in WordPress admins to install a PHP backdoor
Original title: New TRUST#GRAFT Attack Tricks WordPress Admin Browsers Into Installing Malicious Plugins
The chain uploads wm.zip as Web Media Optimizer and copies itself to mu-plugins so deleting the visible plugin leaves it loaded.
Securonix describes TRUST#GRAFT, a browser-side chain that does not bypass WordPress authentication. If an administrator is already signed in, the script reads the plugin-upload nonce, posts a staged ZIP named wm.zip to update.php?action=upload-plugin, and activates a PHP plugin called Web Media Optimizer, version 2.1. The plugin injects remote JavaScript, disables TLS verification for its controller fetch, hides from plugin lists, and on activation copies itself to wp-content/mu-plugins/wmedia-recovery.php. The initial delivery vector is unconfirmed.
Unconfirmed: Securonix says the initial delivery vector is unconfirmed and hosting details are not attribution.
- A fake Cloudflare “Just a moment” iframe covers the page while fingerprinting and a proof-of-work check run.
- The loader copies attacker text to the clipboard and posts tokens plus up to 1,500 characters of document.cookie.
- HttpOnly cookies are not readable; page-accessible storage keys such as token, jwt, and csrf are.
- A hardcoded token can set an auth cookie for the first administrator or change the remote script source.
- Loader candidates were seen on gerlace[.]com, vtevens[.]icu, and caapman[.]me; hosting is not attribution.
Impact: Persistent PHP backdoor installed through an admin browser session
| Product | Affected |
|---|---|
| WordPress | — |
- 1.Inspect wp-content/mu-plugins for wmedia-recovery.php, not only the Plugins screen.
- 2.Correlate one admin session that uploads a ZIP and activates a plugin in succession.
- 3.Avoid routine browsing in a signed-in wp-admin profile and reauthenticate after suspected compromise.
- ATT&CK
- T1539 Steal Web Session CookieT1078 Valid AccountsT1505.003 Web ShellT1059.007 JavaScriptT1204 User Execution
- Products
- WordPressWeb Media Optimizer
- Organizations
- Securonix
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | caapman.me | idates were identified on gerlace[.]com, vtevens[.]icu, and caapman[.]me, and the /p/wm.zip path recurs across several domains. Th |
| domain | gerlace.com | r remains unconfirmed. Loader candidates were identified on gerlace[.]com, vtevens[.]icu, and caapman[.]me, and the /p/wm.zip path |
| domain | vtevens.icu | firmed. Loader candidates were identified on gerlace[.]com, vtevens[.]icu, and caapman[.]me, and the /p/wm.zip path recurs across s |
| sha256 | 2dfa9e708fdb92e5d36080065f978e33a692c0fe813a75be9c7cdff03be51b6e | 59541cd2b0b967fac65ce20c60e483c71c9f7e108d5ad0bd564 ads.php 2dfa9e708fdb92e5d36080065f978e33a692c0fe813a75be9c7cdff03be51b6e wm.zip 9215d17e5138cee498bb529e69b1cc7267305136535025e9b49f |
| sha256 | 86d775c2d5cb459541cd2b0b967fac65ce20c60e483c71c9f7e108d5ad0bd564 | atters. IOCs File Names Relevant SHA256 wmedia-recovery.php 86d775c2d5cb459541cd2b0b967fac65ce20c60e483c71c9f7e108d5ad0bd564 ads.php 2dfa9e708fdb92e5d36080065f978e33a692c0fe813a75be9c7 |
| sha256 | 9215d17e5138cee498bb529e69b1cc7267305136535025e9b49fe173cf648720 | 92e5d36080065f978e33a692c0fe813a75be9c7cdff03be51b6e wm.zip 9215d17e5138cee498bb529e69b1cc7267305136535025e9b49fe173cf648720 Note: IP addresses and domains are intentionally defanged ( |
From the original article
3 min read at gbhackers.com
TRUST#GRAFT, a JavaScript-to-WordPress attack chain that never breaks WordPress authentication. Instead, it borrows the trust placed in an already logged-in administrator’s browser and uses that session to install a persistent PHP backdoor. Many administrators stay signed in to wp-admin in the same profile they use for everyday browsing.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.