Upon execution, the malware fetches remote payloads from a concealed URL and stores them directly in the WordPress database under the option key “_hdra_core”, effectively bypassing filesystem-based security scans that focus primarily on file modifications. A sophisticated WordPress malware campaign has been discovered operating through the rarely monitored mu-plugins directory, giving attackers persistent access to compromised websites while evading traditional security measures. This approach ensures the malware survives standard cleanup procedures while providing attackers with remote code execution capabilities and complete administrative control over compromised WordPress installations. The researchers observed that the malware creates a hidden administrative user named “officialwp” while simultaneously hiding its presence from the WordPress user interface through carefully crafted filter functions. This framework includes a covert file manager disguised as “pricing-table-3.php” within the active theme directory, protected by a custom authentication token “fsociety_OwnzU_4Evr_1337H4x!” transmitted via HTTP headers. The malicious code, identified as wp-index.php, exploits WordPress’s “must-use plugins” functionality to maintain continuous operation without the possibility of deactivation through the admin panel. Sucuri analysts identified this particularly insidious threat during routine malware investigations, noting its exceptional ability to maintain persistence across multiple infection vectors. Rather than relying solely on file-based infections that can be detected through integrity monitoring, the backdoor stores its payload within WordPress’s options table.utes this stored payload before immediately cleaning up temporary files, leaving minimal forensic evidence. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The primary loader script retrieves base64-encoded payloads from the remote server at hxxps://1870y4rr4y3d1k757673q[.]xyz/cron.php, which when decoded reveals a comprehensive malware framework.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 24 Jul 2025 08:05:21 +0000