A Turkish-speaking threat actor is operating a campaign that compromises WordPress sites to inject hidden backlinks for a Private Blog Network (PBN), likely tied to gambling and adult affiliate niches. The actor uses a fake plugin named 'Beloved PBN Entegrasyonu' to inject arbitrary HTML/JavaScript and beacon site URLs to an external API.