WordPress Malware Uses Hidden Plugin and Blockchain C2 to Stay Undetected
Wordfence found WordPress malware that hides as a must-use plugin and uses Ethereum EtherHiding for command and control.
Wordfence identified a WordPress malware strain, found during a mid-June cleanup, that installs as a must-use plugin under more than 4,000 filenames and hides from plugin and health screens. It can create or hijack administrator accounts, capture login passwords, and search configuration, environment, and Git files for payment and cloud secrets. Command-and-control uses EtherHiding: the implant queries Ethereum smart contracts through public RPC gateways to obtain attacker HTTP servers. The backdoor can self-repair, remove security plugins, inject JavaScript, and spread to other WordPress sites on the same server.
- Hidden must-use plugin loads on every request and hides from the dashboard.
- Creates concealed administrator accounts and captures passwords at login.
- EtherHiding reads C2 addresses from Ethereum smart contracts at runtime.
- Harvests payment, cloud, and API secrets and can inject visitor JavaScript.
- Self-repairs from a database backup and can copy itself to co-hosted sites.
From the original article
5 min read at cybersecuritynews.com
A newly identified WordPress malware strain is using a hidden plugin, stolen administrator access, and a blockchain-based command channel to remain active on compromised websites. The threat is built to survive common cleanup efforts while quietly collecting sensitive data from affected servers. The malware is installed as a must-use plugin, a type of WordPress component […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.