Wordfence’s Threat Intelligence Team found an unusually persistent piece of malware while cleaning up an infected site in mid-June. The attackers had installed it as a “must-use” plugin, a plugin type WordPress loads automatically on every request without ever listing it on your normal Plugins screen, which made it easy to miss.

What happened

Must-use plugins, often called mu-plugins, live in a special wp-content/mu-plugins folder. WordPress runs anything in that folder automatically and doesn’t let you deactivate it from the dashboard the way you would a regular plugin, so it’s a favorite hiding spot for attackers. Wordfence says this sample went further: it had several self-healing mechanisms built in, designed to reinstall or reactivate itself if a site owner removed it.

The malware also used a technique called Etherhiding. Instead of pointing to a normal domain that a host or registrar could take down, the malware looked up its instructions from a smart contract stored on the Ethereum blockchain. Blockchain data isn’t controlled by any single company, so there’s no single party who can pull it offline the way a hosting provider can suspend a malicious website, which makes the attacker’s command channel much harder to shut down.

Wordfence built a detection signature for the sample and released it to Wordfence Premium, Care, and Response customers on June 23. Users on the free version of Wordfence received the same protection after the standard 30-day delay, so free-tier sites have been covered since around July 23.

What to do

  1. Check your wp-content/mu-plugins folder directly for files you don’t recognize. Mu-plugins won’t show up on your Plugins screen, so you have to look there specifically.
  2. Because this malware is built to reinstall itself, deleting a suspicious file alone may not be enough. Also close whatever let the attacker in in the first place, such as an outdated plugin or a stolen login, or the infection can return.
  3. Run a full scan with a security plugin that has current threat signatures, such as Wordfence, rather than relying on a manual look through your files.
  4. If you’re not sure whether your site was affected, ask your host or a security professional to check server logs from before June 23 for unfamiliar file activity in mu-plugins.

End of article