A Wordfence threat-intelligence analysis has exposed a malicious WordPress must-use plugin that is built to stay hidden, resist removal, and keep its foothold even after cleanup attempts. The malware uses self-healing routines, account abuse, dashboard hiding tricks, and EtherHiding — a blockchain-based method for masking command-and-control infrastructure — to make takedown efforts far more difficult.
Why this WordPress must-use plugin stood out
The sample was identified in mid June during a site cleanup and was disguised as a legitimate automated health check and reporting tool. It carried a plausible author name and a link to a code repository, but its behavior was much more sinister: the malware was installed as a must-use plugin, meaning WordPress loads it automatically on every request and the standard Plugins screen cannot deactivate it.
Wordfence said the malware appeared under more than 4,000 distinct filenames, including familiar-looking WordPress drop-ins such as advanced-cache.php and db.php, as well as a theme functions.php. That variation is important because the Plugin Name, Author, and Plugin URI fields also changed from sample to sample, making metadata a poor indicator for detection.
How the malware stays hidden
The plugin uses several layers of obfuscation to make analysis harder. Rather than relying on common patterns such as eval(base64_decode(...)), it hides hook names, option keys, constants, and file paths behind a custom string decoder. Wordfence described the method as a simple substitution cipher that reconstructs strings only when needed at runtime.
Some SQL statements are also obscured with hexadecimal escape codes, which PHP resolves at execution time. That means the queries still run normally while remaining less obvious to a human reader or basic scanning tool.
Dashboard hiding goes beyond mu-plugins
Running as a must-use plugin already keeps the malware out of the standard plugin list, but the sample goes further. It hooks filters that remove itself from the Must-Use Plugins view, the normal Plugins page, update notices, and the Site Health screen.
According to Wordfence, one filter modifies show_advanced_plugins so the plugin disappears before WordPress renders the page. That kind of hiding makes manual discovery much harder for site administrators.
Persistence mechanisms designed to survive cleanup
The malware layers multiple persistence mechanisms so removing one component does not necessarily remove the infection. Its first move is often to establish or hijack administrator access, then hide that access, then preserve the file on disk, and finally restore itself if deleted.
A rogue administrator account
The code checks whether it has already created an admin account by reading a username stored in the database. If it finds a matching account, it can reset that account’s password and reuse the existing login rather than creating an extra user. If no suitable account exists, it generates a username from one of four prefixes — admin_, adm_, administrator_, or backup_ — followed by a six-character suffix.
Wordfence noted that the account details are written to the malware’s own options, allowing it to recover credentials later. The compromised account is then hidden from the Users screen, the REST API, and role-count displays so the totals still appear consistent.
Plaintext passwords from administrator logins
The plugin also hooks WordPress’s authenticate filter and captures plaintext passwords whenever an administrator logs in successfully. Those credentials are stored in an option named ic, keyed by username. That gives the attacker a ready-made cache of administrator passwords in plaintext.
Self-healing and self-reactivation
If the malware file is deleted or shrunk below a size threshold, it can restore itself from a saved copy in the src option. Wordfence said the file is rewritten to disk, backdated, and then marked read-only to make the restoration look less suspicious.
It can also write itself back into WordPress’s active_plugins option directly, bypassing the normal activation process. The technique relies on reading database details from wp-config.php and then updating the option inside a transaction, which helps the malware reactivate itself even after attempted cleanup.
Spreading to other WordPress installations
Another notable feature is its ability to search the filesystem for additional WordPress installs and drop copies into them. Wordfence said the malware targets common web-server roots including /home, /var/www, /var/www/vhosts, /var/www/html, /srv/www, /srv/users, and /usr/local/www, plus paths relative to its own location.
On shared hosting environments, that behavior can turn one infection into several. The malware prefers wp-content/mu-plugins, but if that fails it falls back to wp-content/plugins, then backdates and locks the file again.
EtherHiding gives the command channel resilience
The command-and-control design is where the sample becomes especially difficult to disrupt. Instead of hard-coding a server address that defenders can block, it uses EtherHiding, a technique that hides server locations behind a smart contract on the Ethereum blockchain.
The malware queries public RPC gateways with an eth_call request and uses the contract response to recover a server key and a list of HTTP server URLs. Wordfence said the sample holds three contract addresses and 21 public RPC gateways, selecting one of each at random for each attempt.
Because the blockchain only points the malware to its current servers, the actual infrastructure can be replaced without changing the implant. If one gateway or server goes down, another can answer, and the attacker can update the contract for the next round of communication.
What the malware steals and what it can change
The report sent to the attacker includes a broad summary of the site and its secrets. Wordfence listed data fields covering the domain, plugin version, filename, filesystem root, login URL, active plugins, mu-plugins, administrator credentials and forged sessions, WooCommerce order data, and API keys.
The malware’s API-key hunting is particularly targeted. It searches wp-config.php, any .env file, and .git/config for constants tied to providers such as Stripe, Braintree, Authorize.Net, and AWS, then also inspects WooCommerce settings for payment-related fields like keys, secrets, tokens, login IDs, and transaction keys.
In return, the command channel can deliver four types of actions: update the malware itself, remove other plugins, strip content from plugin files, or inject JavaScript into visitors’ browsers. Wordfence said the plugin code demonstrates capability, not necessarily every instruction the attacker has used.
What site owners should look for
- An unfamiliar must-use plugin in
wp-content/mu-pluginswith heavily obfuscated code. - An unauthorized admin user named with a prefix such as
admin_,adm_,administrator_, orbackup_followed by six random characters. - Suspicious database options including
src,bu,bp, andic. - Unexpected custom cron schedule names, which may be used by the plugin.
Detection and response
Wordfence said it developed and released a detection signature after its quality-assurance process on June 23, 2026. All Wordfence Premium, Wordfence Care, and Wordfence Response customers received the signature immediately, while free users received it after the standard 30-day delay.
The broader takeaway is that this sample combines stealth, persistence, and a blockchain-backed command path in a way that is explicitly designed to frustrate normal cleanup steps. For defenders, the safest approach is to inspect the database directly, verify unexpected mu-plugin files, and assume any hidden admin access or unusual payment-related secrets may have been compromised.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: September 22, 2026 at 10:34 pm
5 views
