My WordPress site was compromised — suspicious MU-plugins and heavily obfuscated JavaScript

I'm investigating a WordPress site that was compromised. My coding/security knowledge is limited, so I used AI to help me analyze the files and understand what was happening.

I found a suspicious MU-plugin called:

focal-extension-evo

The file is currently 0 bytes, but its filesystem timestamps are interesting. It appears to have been created around August 14, 2026, and there is also a serialized reference to it in wp_options.

With the help of AI, I was able to reconstruct part of the heavily obfuscated JavaScript associated with the infection.

The JavaScript makes a POST request to:

https://fashion-chicken.com/x9i32md/w1/

It also contains an eval() mechanism that appears capable of executing the response received from the remote server.

I did not execute the code or contact the remote server.

Threat-intelligence checks also show that fashion-chicken.com is associated with malicious infrastructure/C2 activity.

Plugins currently installed

These are the plugins actually reported by WordPress on this installation:

Active:

• Classic Editor 1.7.0
• Elementor 4.2.4
• Elementor Pro 3.35.0
• JetEngine 3.8.14.3
• WPvivid Backup Pro 2.2.30

Inactive:

• BDThemes Element Pack Lite 8.8.2
• JetFormBuilder 3.6.5.2
• WP Lorem Ipsum Generator 0.3
• Rank Math 1.0.277.2
• Rank Math Pro 3.0.106
• WooCommerce 11.0.1
• WP Cafe 3.0.19
• WP Cafe Pro 3.0.5
• WP Mail SMTP 4.9.0

Suspicious MU-plugins found

WordPress is also reporting these as must-use plugins:

• focal-extension-evo
• ionic-dashboard-ultra
• jolt-librarian-vox
• lumen-logger-io
• max-exporter-tag
• page-compiler-jet
• web-extension-evo

There are also these drop-ins:

• advanced-cache.php
• db.php
• maintenance.php

I'm now working on cleaning the installation and determining how the malicious files were introduced.

The AI assistance has been extremely useful because my knowledge of malware analysis and heavily obfuscated JavaScript is limited. It helped me decode the JavaScript and identify the suspicious external communication without executing the malware.

Is anyone else dealing with something similar? Are you using any of the plugins listed above? Has anyone seen focal-extension-evo, web-extension-evo, or the other MU-plugins mentioned here before?