TRUST#GRAFT uses logged-in WordPress admins to install a PHP backdoor
The chain uploads wm.zip as Web Media Optimizer and copies itself to mu-plugins so deleting the visible plugin leaves it loaded.
Stories per day · 30 days
4 stories, newest first · one card per story
Stories tagged #must-use-plugin
WordPress Malware Uses Hidden Plugin and Blockchain C2 to Stay Undetected
Wordfence found WordPress malware that hides as a must-use plugin and uses Ethereum EtherHiding for command and control.
Stealthy WordPress Malware Uses Must-Use Plugin and Ethereum EtherHiding for Persistent Backdoor Access
Wordfence details a WordPress must-use plugin backdoor that steals credentials and hides C2 on Ethereum.
Inside a Malicious, Stealthy WordPress Must Use Plugin
Wordfence analyzed WordPress malware installed as a must-use plugin that self-heals to survive removal.