Hello WordPressers :)

I was tasked to look into two compromised WordPress sites. The people who own them, tried to remove the virus but failed. I wanted to describe what the virus was doing.

Overall this is a self-propagating, self-healing, obfuscated, hidden executor virus with size-padding evasion tactics.

It generated the following files and directories:

• /home/foobar/public_html/wp-content/.sc_494g1672
• /home/foobar/public_html/wp-content/.gk_eb46c3gc
• /home/foobar/public_html/wp-content/.kk_cb505c82
• /home/foobar/public_html/wp-content/ab743742.zip
• /home/foobar/public_html/wp-content/uploads/2026/10/ab743742.zip
• /home/foobar/public_html/wp-content/plugins/agile-beacon-go
• /home/foobar/public_html/wp-content/plugins/hyper-proxy-cue
• /home/foobar/public_html/wp-content/plugins/nexus-curator-rig
• /home/foobar/public_html/wp-content/plugins/swift-keeper-dex
• /home/foobar/public_html/wp-content/mu-plugins/.bt_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.pv_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.sd_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.swm_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/hyper-proxy-cue.php
• /home/foobar/public_html/mu-plugins/hyper-proxy-cue.php

Each compromised site received its own hash, thus the ab743742 you see above is the unique hash for this compromised site. The value re-appears in several places.

The virus infects the functions.php of the current theme, it adds a variable with the contents of the ab743742.zip file. When the site runs, the variable contents are gzdecode'ed gzinflat'ed and stored as the above zip file, which gets extracted under the plugins directory.

The virus generates a self-preserving "must-use" plugin under the mu-plugins directory.

The virus creates its own admin user in the SQL table wp_users and modifies WordPress files so that its own admin user is invisible.

Finally, the virus creates the .sc_[HASH VALUE] directory under wp-content which stores a specially crafted PHP cli script. This script is executed via exec() or other similar function, once its loaded the script deletes itself so it only remains resident in memory. This monitors all the above files and re-generates the whole infection.

At first glance, the virus tries to access a master server and receives instructions. In this case, it started adding hidden URLs inside the generated WordPress pages.

A few interesting things about this virus:

• It uses token_get_all() to validate its own PHP syntax before making modifications to the site, so that does not corrupt the site and get noticed.
• It uses function_exists() to test for various functions, so it can understand what it can do to its host server.
• It generates a padding size for modified files, so that it matches the target size and avoid detection from scanners that check file size.
• It generates various "sidecar" files with quality markers in MD5, a version file, rate limits (regenerate itself every 4 minutes) and a write race/lock flag.
• It executes hidden commands from wp-content/.sc_[HASH VALUE}.php files that act as commands imported from its master control server.

The following strings can used to grep/search for the infection:

• SCV:
• SC_TH_BEGIN
• hyper-proxy-cue
• _sc_fam
• _sc_commit

Let me know if you need more details!

EDIT with information about the plugin*

The plugin has its own replication and cleanup code. It detects the presence of itself by looking for the string /* SCV:x.x.x */ where x.x.x is the version number of the virus. If there is a newer version then it overwrites itself.

It replicates by scanning various directories like /home, /var/www. It also modifies advanced-cache.php and object-cache.php.

The main code does:

• List Ethereum JSON-RPC endpoints and contract addresses.
• Receives an Ethereum contract with remote commands.
• It sends server information like domain, plugins, admin users+passwords, session cookies, etc.
• It receives remote code and executes it.
• It has some obfuscated code to detect legitimate plugins, it modifies some of them.

Interestingly, it uses wp_generate_auth_cookie() to generate an admin session that sends this back to its control server, thus the attacker can login to wordpress without knowing the password of the admin.

On the front-end side, it adds Javascript code that runs its own Service Worker for intercepting web traffic.

It does various other things that I can't be bothered to write about :)

Hello WordPressers :)

I was tasked to look into two compromised WordPress sites. The people who own them, tried to remove the virus but failed. I wanted to describe what the virus was doing.

Overall this is a self-propagating, self-healing, obfuscated, hidden executor virus with size-padding evasion tactics.

It generated the following files and directories:

• /home/foobar/public_html/wp-content/.sc_494g1672
• /home/foobar/public_html/wp-content/.gk_eb46c3gc
• /home/foobar/public_html/wp-content/.kk_cb505c82
• /home/foobar/public_html/wp-content/ab743742.zip
• /home/foobar/public_html/wp-content/uploads/2026/10/ab743742.zip
• /home/foobar/public_html/wp-content/plugins/agile-beacon-go
• /home/foobar/public_html/wp-content/plugins/hyper-proxy-cue
• /home/foobar/public_html/wp-content/plugins/nexus-curator-rig
• /home/foobar/public_html/wp-content/plugins/swift-keeper-dex
• /home/foobar/public_html/wp-content/mu-plugins/.bt_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.pv_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.sd_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.swm_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/hyper-proxy-cue.php
• /home/foobar/public_html/mu-plugins/hyper-proxy-cue.php

Each compromised site received its own hash, thus the ab743742 you see above is the unique hash for this compromised site. The value re-appears in several places.

The virus infects the functions.php of the current theme, it adds a variable with the contents of the ab743742.zip file. When the site runs, the variable contents are gzdecode'ed gzinflat'ed and stored as the above zip file, which gets extracted under the plugins directory.

The virus generates a self-preserving "must-use" plugin under the mu-plugins directory.

The virus creates its own admin user in the SQL table wp_users and modifies WordPress files so that its own admin user is invisible.

Finally, the virus creates the .sc_[HASH VALUE] directory under wp-content which stores a specially crafted PHP cli script. This script is executed via exec() or other similar function, once its loaded the script deletes itself so it only remains resident in memory. This monitors all the above files and re-generates the whole infection.

At first glance, the virus tries to access a master server and receives instructions. In this case, it started adding hidden URLs inside the generated WordPress pages.

A few interesting things about this virus:

• It uses token_get_all() to validate its own PHP syntax before making modifications to the site, so that does not corrupt the site and get noticed.
• It uses function_exists() to test for various functions, so it can understand what it can do to its host server.
• It generates a padding size for modified files, so that it matches the target size and avoid detection from scanners that check file size.
• It generates various "sidecar" files with quality markers in MD5, a version file, rate limits (regenerate itself every 4 minutes) and a write race/lock flag.
• It executes hidden commands from wp-content/.sc_[HASH VALUE}.php files that act as commands imported from its master control server.

The following strings can used to grep/search for the infection:

• SCV:
• SC_TH_BEGIN
• hyper-proxy-cue
• _sc_fam
• _sc_commit

Let me know if you need more details!

EDIT with information about the plugin*

The plugin has its own replication and cleanup code. It detects the presence of itself by looking for the string /* SCV:x.x.x */ where x.x.x is the version number of the virus. If there is a newer version then it overwrites itself.

It replicates by scanning various directories like /home, /var/www. It also modifies advanced-cache.php and object-cache.php.

The main code does:

• List Ethereum JSON-RPC endpoints and contract addresses.
• Receives an Ethereum contract with remote commands.
• It sends server information like domain, plugins, admin users+passwords, session cookies, etc.
• It receives remote code and executes it.
• It has some obfuscated code to detect legitimate plugins, it modifies some of them.

Interestingly, it uses wp_generate_auth_cookie() to generate an admin session that sends this back to its control server, thus the attacker can login to wordpress without knowing the password of the admin.

On the front-end side, it adds Javascript code that runs its own Service Worker for intercepting web traffic.

It does various other things that I can't be bothered to write about :)

Hello PHPers :)

I was tasked to look into two compromised WordPress sites. The people who own them, tried to remove the virus but failed. I wanted to describe what the virus was doing.

Overall this is a self-propagating, self-healing, obfuscated, hidden executor virus with size-padding evasion tactics.

It generated the following files and directories:

• /home/foobar/public_html/wp-content/.sc_494g1672
• /home/foobar/public_html/wp-content/.gk_eb46c3gc
• /home/foobar/public_html/wp-content/.kk_cb505c82
• /home/foobar/public_html/wp-content/ab743742.zip
• /home/foobar/public_html/wp-content/uploads/2026/10/ab743742.zip
• /home/foobar/public_html/wp-content/plugins/agile-beacon-go
• /home/foobar/public_html/wp-content/plugins/hyper-proxy-cue
• /home/foobar/public_html/wp-content/plugins/nexus-curator-rig
• /home/foobar/public_html/wp-content/plugins/swift-keeper-dex
• /home/foobar/public_html/wp-content/mu-plugins/.bt_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.pv_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.sd_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.swm_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/hyper-proxy-cue.php
• /home/foobar/public_html/mu-plugins/hyper-proxy-cue.php

Each compromised site received its own hash, thus the ab743742 you see above is the unique hash for this compromised site. The value re-appears in several places.

The virus infects the functions.php of the current theme, it adds a variable with the contents of the ab743742.zip file. When the site runs, the variable contents are gzdecode'ed gzinflat'ed and stored as the above zip file, which gets extracted under the plugins directory.

The virus generates a self-preserving "must-use" plugin under the mu-plugins directory.

The virus creates its own admin user in the SQL table wp_users and modifies WordPress files so that its own admin user is invisible.

Finally, the virus creates the .sc_[HASH VALUE] directory under wp-content which stores a specially crafted PHP cli script. This script is executed via exec() or other similar function, once its loaded the script deletes itself so it only remains resident in memory. This monitors all the above files and re-generates the whole infection.

At first glance, the virus tries to access a master server and receives instructions. In this case, it started adding hidden URLs inside the generated WordPress pages.

A few interesting things about this virus:

• It uses token_get_all() to validate its own PHP syntax before making modifications to the site, so that does not corrupt the site and get noticed.
• It uses function_exists() to test for various functions, so it can understand what it can do to its host server.
• It generates a padding size for modified files, so that it matches the target size and avoid detection from scanners that check file size.
• It generates various "sidecar" files with quality markers in MD5, a version file, rate limits (regenerate itself every 4 minutes) and a write race/lock flag.
• It executes hidden commands from wp-content/.sc_[HASH VALUE}.php files that act as commands imported from its master control server.

The following strings can used to grep/search for the infection:

• SCV:
• SC_TH_BEGIN
• hyper-proxy-cue
• _sc_fam
• _sc_commit

Let me know if you need more details!

EDIT with information about the plugin

The plugin has its own replication and cleanup code. It detects the presence of itself by looking for the string /* SCV:x.x.x */ where x.x.x is the version number of the virus. If there is a newer version then it overwrites itself.

It replicates by scanning various directories like /home, /var/www. It also modifies advanced-cache.php and object-cache.php.

The main code does:

• List Ethereum JSON-RPC endpoints and contract addresses.
• Receives an Ethereum contract with remote commands.
• It sends server information like domain, plugins, admin users+passwords, session cookies, etc.
• It receives remote code and executes it.
• It has some obfuscated code to detect legitimate plugins, it modifies some of them.

Interestingly, it uses wp_generate_auth_cookie() to generate an admin session that sends this back to its control server, thus the attacker can login to wordpress without knowing the password of the admin.

On the front-end side, it adds Javascript code that runs its own Service Worker for intercepting web traffic.

It does various other things that I can't be bothered to write about :)

I also posted this in /r/Wordpress but the post was removed by the moderators, so I'm posting on /r/PHP to raise awareness