The giveaway is a number that has been quietly adjusted. This WordPress malware creates its own administrator account, then hides it from the Users page, hides it from the REST API, and subtracts one from the "All" and "Administrator" totals displayed above the list, so an administrator checking their site sees a count that matches what they are looking at. Wordfence's Threat Intelligence team pulled the sample off a customer site during a mid-June clean, and the write-up published this week is a catalogue of a plugin built to be very hard to get rid of.
Janet Katile set out the analysis for Wordfence. A detection signature shipped to Wordfence Premium, Care and Response customers on 23 June, with free users receiving it after the usual 30-day delay. Across their detections the same malware turned up under more than 4,000 different filenames, most commonly disguised as legitimate WordPress drop-ins such as advanced-cache.php and db.php, or as a theme's functions.php. The plugin name, author and URI fields change between samples too, so none of that metadata is worth much as an indicator.
Why it lives in mu-plugins
Must-use plugins load on every WordPress request and cannot be switched off from the Plugins screen. That makes them useful for genuine site-wide code and ideal for persistent malware. This one goes further and filters itself out of the Must-Use Plugins view, the Plugins page, update notices and the Site Health screen. Its strings are not the familiar eval and base64 pattern either: hook names, option names and file paths sit behind a custom substitution cipher with two hand-built alphabets, so the WordPress API calls are visible while the values passed to them are not.
Delete the file and it writes itself back
Three mechanisms keep it resident. It hooks the authenticate filter, which hands it the plaintext password of every administrator who logs in, and stores those in an option of its own. It keeps a copy of its own source in the database and checks hourly whether the file on disk is missing or under 5,000 bytes, restoring it if so, then backdating the modification time and setting the file read-only so it looks untouched. Every three days it hunts for other WordPress installations under paths like /home, /var/www and /srv/www and drops a copy into each one it can write to, which on shared hosting means a single infected site can seed every other site on the box.
A command server address you cannot block
The most interesting piece is what is not in the file: an address. Instead of hard-coded domains, the malware reads its command servers off the Ethereum blockchain, a technique known as EtherHiding. It carries three smart contract addresses and twenty-one public RPC gateways, picks one of each at random, and sends an ordinary read-only eth_call, the same request any legitimate application makes to query a contract. The reply decodes to an encryption key and a list of real command server addresses. Take those servers down and the operator just updates the contract. There is no single endpoint to blocklist, and blocking public Ethereum gateways is not realistic for most hosts.
Check the database, not the dashboard
Because the account is filtered out of both the dashboard and the REST API, querying the users table directly is the only reliable way to see it. Look for administrator accounts whose usernames start with admin_, adm_, administrator_ or backup_ followed by six random characters, and note that on sites where a suitable account already existed the malware reset its password and took it over instead, leaving the user count genuinely unchanged. Then check wp-content/mu-plugins for files you did not put there, particularly read-only ones with implausibly old timestamps, and rotate every administrator password, since the plaintext ones have been sitting in the options table. WordPress sites remain the softest large target on the web, whether the way in is a stolen admin session or, as in a recent theft of 18,000 government records, a compromised site used as a staging post.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.