WORDFENCE researchers have identified a persistent WordPress backdoor deployed as a must-use (MU) plugin across thousands of websites, particularly sites running WooCommerce. The threat actor and initial intrusion method remain unconfirmed, although the malware may be placed in the `wp-content/mu-plugins` directory after attackers obtain filesystem access through compromised administrator credentials or web vulnerabilities.
Wordfence reportedly observed more than 4,000 distinct filenames, with samples impersonating files such as `advanced-cache.php` and `db.php`, making filename-based detection unreliable.
Because MU plugins load automatically and cannot be disabled through the normal WordPress Plugins screen, the implant can conceal itself from administrators. It uses custom character substitution to obfuscate PHP functions, database keys and paths, hides its entries and warnings from the dashboard, and creates concealed administrator accounts. Authentication hooks can capture administrator passwords in plaintext.
Self-healing routines restore deleted files from a database copy hourly, backdate timestamps and scan nearby directories every three days to infect other sites on shared hosting.
The malware uses EtherHiding to obtain encrypted configuration from Ethereum smart contracts through public blockchain gateways, rather than relying on fixed command-and-control domains. The returned data provides control-server addresses and encryption keys. The implant can exfiltrate credentials, session cookies, database paths and payment-related keys from services including Stripe, Braintree, Authorize.Net and Amazon Web Services.
Operators can also update the malware, remove security-plugin code and inject JavaScript into site footers. Wordfence’s guidance is to inspect `mu-plugins` using command-line tools or SFTP, query `wp_users` and `wp_options` directly, and clean both the database and filesystem. Affected site owners should rotate administrator, database and payment API credentials.