Stealthy Malware Leveraging Variable Functions and Cookies for Evasion

Cybersecurity researchers at Wordfence Threat Intelligence and their Care and Response teams have observed a persistent trend in new malware that relies on heavy obfuscation through variable functions and cookie manipulation to evade detection, a tactic the article presents as the malware’s core mechanism.

One analyzed strain requires exactly 11 cookies to assemble function names and executable code segments, concatenating values containing “base64_” and “decode” into the function name base64_decode before decoding and running the resulting code. A second sample uses a boolean cookie-based condition, transforms obfuscated strings via str_replace to yield true function names, and unserialises payloads from cookies to create and run malicious actions.

A third example hinges on a count check for 22 cookies and a cookie containing “array22,” employing chained variable function calls and concatenations to execute an anonymous function, adding a layered control flow. In September 2025, Wordfence signatures detecting these techniques logged over 30,000 detections, underscoring the ongoing need for behavioural and heuristic detection alongside traditional signatures.