Stealthy PHP Malware Uses ZIP Archive to Redirect WordPress Visitors
A sophisticated piece of malware was discovered embedded in a WordPress site's core files, specifically in wp-settings.php. The malware uses a ZIP archive to hide malicious code and perform search engine poisoning and unauthorized content injection. It employs dynamic Command and Control server selection, anti-bot mechanisms, and manipulates SEO-related files. The malware's main goals include manipulating search engine rankings, injecting spam content, and performing unauthorized redirects. It uses obfuscation techniques and ZIP archives for code inclusion, making it challenging to detect and remove. Prevention measures include keeping software updated, using reputable sources for themes and plugins, implementing strong credential security, utilizing a Web Application Firewall, and regularly scanning for malware.
Pulse ID: 68750b271ed247073ded7ab1
Pulse Link: https://otx.alienvault.com/pulse/68750b271ed247073ded7ab1
Pulse Author: AlienVault
Created: 2025-07-14 13:50:30
Be advised, this data is unverified and should be considered preliminary. Always do further verification.