Cybersecurity researchers have uncovered a sophisticated campaign targeting WordPress websites by disguising malware as legitimate security plugins. The primary malicious plugin, named “WP-antymalwary-bot.php,” comes equipped with advanced capabilities designed to maintain persistent access while hiding from site administrators.

## Malware Capabilities and Variants

The malware, first discovered during a site cleanup in January 2025, provides attackers with administrator access and leverages the WordPress REST API for remote code execution. It can inject malicious PHP code into theme header files and clear popular caching plugins.

Other variants of this malware have been identified under different names:
– addons.php
– wpconsole.php
– wp-performance-booster.php
– scr.php

Recent iterations show evolution in how code injections are handled, now fetching malicious JavaScript from other compromised domains to serve ads or spam content.

## Persistence Mechanisms

The attackers have implemented sophisticated persistence techniques, including a modified wp-cron.php file that automatically recreates and reactivates the malware upon site visits if removed from the plugins directory. This ensures continued access even after cleanup attempts.

While the initial infection vector remains unclear, Russian language comments within the code suggest Russian-speaking threat actors may be behind the campaign.

## Other Related Threats

Researchers have also identified several other concurrent threats targeting websites:

– A web skimmer using a fake fonts domain (“italicfonts[.]org”) to steal payment information
– Multi-stage attacks on Magento e-commerce sites using fake GIF files as PHP scripts
– Injection of unauthorized Google AdSense code to hijack ad revenue
– Deceptive CAPTCHA verifications delivering Node.js backdoors attributed to the Kongtuke traffic distribution system

These sophisticated attacks highlight the evolving threat landscape for website owners and the importance of maintaining robust security practices.