WordPress Malware Uses Ethereum Blockchain for Stealthy Persistence
Threat actors are deploying persistent WordPress malware that uses must-use plugins and Ethereum smart contracts to bypass security removal attempts.
Threat intelligence analysts found a WordPress malware sample that uses a must-use plugin architecture for persistence. Masquerading as a core component, the code implements self-healing mechanisms to bypass standard removal attempts by administrators.
The attack relies on Etherhiding for command and control. This technique stores attacker server locations within a smart contract on the Ethereum blockchain. The decentralized structure prevents traditional takedown efforts by removing single points of failure and centralized servers.
Discovered during a routine site cleanup, the malware targets the wp-content/mu-plugins directory. Must-use plugins load automatically before standard plugins, granting the malicious code an early execution window and high privileges. This architecture keeps the infection operational when administrators try to disable common plugins or modify standard directory permissions.
Advisories recommend monitoring wp-content/mu-plugins for unauthorized files. Because the self-healing code re-establishes itself if components are removed in isolation, standard file-level deletion may fail. Secure server log audits and plugin directory integrity checks are required to defend against the threat.