WordPress Malware Uses Hidden Plugin and Blockchain C2 to Stay Undetected

A newly identified WordPress malware strain is using a hidden plugin, stolen administrator access, and a blockchain-based command channel to remain active on compromised websites.

The threat is built to survive common cleanup efforts while quietly collecting sensitive data from affected servers. The malware is installed as a must-use plugin, a type of WordPress component that loads automatically with every request and does not appear in the normal Plugins page.

This placement gives attackers a reliable foothold and makes the malicious code easier to conceal from site owners during routine checks.

Researchers at Wordfence identified the malware during a site cleanup in mid-June and found that it was disguised as a normal health-check and reporting tool.

The samples appeared under more than 4,000 different filenames, often using familiar names such as advanced-cache.php, db.php, and a theme’s functions.php.

The infection can create or take over administrator accounts, capture administrator passwords during login, and search for payment-related secrets.

Its operators can also use the implant to inject browser-side code, remove other plugins, alter plugin content, and spread to other accessible WordPress installations on the same server. This makes a single compromised site a potential risk for every site sharing its hosting environment.

Wordfence said in a report shared with Cyber Security News (CSN) that the malware combines stealth, persistence, and a resilient command-and-control design intended to defeat conventional detection and removal efforts.

The findings also reinforce why administrators should review suspicious account activity after incidents, especially following attacks that exploit WordPress flaws to steal passwords and install server-side backdoors.

The malware hides inside the wp-content/mu-plugins directory, where must-use plugins are automatically loaded by WordPress. Unlike ordinary plugins, they cannot be disabled through the standard dashboard, giving attackers an immediate advantage after they gain write access to a site.

It also actively removes itself from WordPress dashboard views. The code hides the plugin from the Must-Use Plugins screen, standard Plugins page, update notices, and Site Health section.

As a result, an administrator may see no obvious warning even when the malicious plugin is executing on every page request. The malware further obscures its activity by using a custom string-substitution system.

Instead of relying on common obfuscation methods that security teams often recognize quickly, it hides WordPress hook names, option names, file paths, and SQL statements until the code runs.

Persistence is layered across several functions. The implant can create a new administrator account with names beginning admin_, adm_, administrator_, or backup_, followed by six random characters.

It can also reset an existing account password, hide the rogue account from dashboard and REST API user listings, and adjust displayed user totals so the discrepancy is less noticeable.

A self-repair feature restores the malware file if it is deleted or becomes too small. The code keeps a backup in the WordPress database, rewrites the file, backdates its modification time, and changes permissions to read-only.

It can also reactivate itself and copy itself to other WordPress sites found in common web-server directories. Administrators investigating compromised sites should not rely only on the Plugins screen.

They should inspect the must-use plugin directory, directly query the WordPress user database for unauthorized administrators, review options tables, rotate credentials, and check other sites hosted on the same server.

Keeping WordPress and plugins updated remains essential, particularly after reports of critical plugin takeover flaws that can offer attackers an initial route into a site.

Blockchain C2 Protects Operations

The malware’s command-and-control system uses EtherHiding, a technique that stores command-server details behind smart contracts on the Ethereum blockchain.

Rather than embedding a fixed malicious domain or IP address, the implant queries blockchain data at runtime to obtain current server addresses.

It selects from three hardcoded smart-contract addresses and 21 public Remote Procedure Call gateways. The malware sends an eth_call request, retrieves encrypted data, and decrypts a key and a list of attacker-controlled HTTP servers.

This setup prevents defenders from simply blocking one domain or reporting one hosting provider to disrupt operations. Once connected, the implant sends an encrypted report containing site details, administrator information, active plugins, payment settings, API keys, customer order data, and paths to important files.

It specifically searches WordPress configuration files, environment files, and Git configuration files for credentials associated with payment services and cloud infrastructure.

The remote server can then return instructions to replace the malware, remove security-related plugins, strip selected content from plugin files, or inject JavaScript into every visitor’s browser through the WordPress footer.

This flexible design means the same infection could support credential theft, payment skimming, spam, redirects, or broader server compromise.

This approach reflects the growing operational use of blockchain infrastructure in malicious campaigns. A recent report on blockchain hidden malware servers similarly described attackers using EtherHiding to make control infrastructure harder to locate and remove.

Site owners should immediately investigate unfamiliar must-use plugins, audit administrator accounts from the database rather than the dashboard alone, review unexpected WordPress options, and inspect server logs for suspicious outbound requests.

They should also apply available WordPress security updates, as recent WordPress security update guidance has stressed the importance of prompt patching and reviewing unexpected files, plugins, and account changes.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File path	wp-content/mu-plugins	Directory where the malware is installed as a hidden must-use plugin
File names	advanced-cache.php, db.php, functions.php	Common legitimate-looking filenames observed among malware samples
Account pattern	admin_xxxxxx	Possible rogue administrator username pattern, with six random trailing characters
Account pattern	adm_xxxxxx	Possible rogue administrator username pattern, with six random trailing characters
Account pattern	administrator_xxxxxx	Possible rogue administrator username pattern, with six random trailing characters
Account pattern	backup_xxxxxx	Possible rogue administrator username pattern, with six random trailing characters
WordPress option	src	Stores a backup copy of the malware’s PHP source code
WordPress option	bu	Stores the malware-created or adopted administrator username
WordPress option	bp	Stores the administrator password used by the malware
WordPress option	ic	Stores usernames and plaintext passwords captured during administrator logins
Cron schedule	jf_7xc5bj9trbgji	Example of an unfamiliar custom WordPress cron schedule associated with the malware
Ethereum function selector	0x3bc5de30	Smart-contract method selector used to retrieve encrypted command-channel information

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC