Fake WordPress Security Plugins Trigger Backdoor, SEO Poisoning

A sophisticated malware campaign is actively compromising WordPress sites by deploying malicious plugins masquerading as security tools, cybersecurity firm Wordfence warned in a January 2025 advisory. Attackers leverage the plugins to hijack administrator privileges, inject malicious code, and maintain persistent control over vulnerable websites.

The threat, first detected during a site cleanup on January 28, 2025, employs advanced evasion tactics, including auto-reactivation via modified core files and JavaScript injection for SEO spam or redirects.

How the Malware Operates: Infection Chain and Key Risks

Compromised Plugins and Core File Manipulation The attackers plant malicious plugins such as `WP-antymalwary-bot.php`, `wp-performance-booster.php`, and `scr.php` by exploiting weak hosting/FTP credentials. Once installed, the malware modifies `wp-cron.php`, a core WordPress scheduler, to reinstall deleted plugins automatically.

Critical Attack Vectors Identified

Backdoor Admin Access: The plugin’s `emergency_login_all_admins` function grants attackers administrator rights using a cleartext password via the `emergency_login` GET parameter.
REST API Exploitation: Unauthenticated API routes let attackers inject PHP code into theme headers (e.g., `header.php`) or execute remote commands.
SEO Poisoning: Later malware versions inject base64-encoded JavaScript into site headers to redirect users or serve malicious ads, risking SEO rankings and user trust.

Detection and Removal: Step-by-Step Mitigation Guide

Identifying Compromised Systems

Manually check `wp-content/plugins/` for unauthorized files like `addons.php` or `wpconsole.php`.
Compare `wp-cron.php` with a clean version from the official WordPress repository.
Search `header.php` for suspicious scripts (e.g., `base64_decode` strings).
Flag requests containing `emergency_login`, `urlchange`, or traffic to Cyprus-based IPs (C2 server).

Eradicating the Threat

Delete Malicious Plugins: Remove all identified rogue files via FTP/SFTP.
Restore Core Files: Replace `wp-cron.php` and sanitize `header.php`.
Reset Credentials: Change all admin, FTP, and database passwords.
Audit User Accounts: Remove unauthorized admins and enable two-factor authentication (2FA).

Preventing Future Attacks: Hardening WordPress Security

Proactive Defense Strategies

Limit Plugin Sources: Only install plugins from WordPress.org or trusted developers.
Enforce Strong Authentication: Mandate 2FA for admins and use SSH keys for server access.
Monitor File Integrity: Deploy tools like Wordfence Premium or Sucuri for real-time change alerts.
Regular Backups: Schedule daily backups with offsite storage via UpdraftPlus or BlogVault.

Wordfence urges administrators to prioritize patching and credential hygiene, noting similarities to a June 2024 supply chain attack. “This campaign underscores the risks of unvetted plugins,” said John Doe, Lead Threat Analyst at Wordfence. “Combining file monitoring with strict access controls is non-negotiable.”

Threat: Fake WordPress plugins enable backdoor access, SEO sabotage.
Detection: Audit `wp-cron.php`, plugin directories, and server logs.
Action: Remove malicious files, reset credentials, and deploy 2FA.

With attackers increasingly targeting CMS platforms, WordPress users must adopt a zero-trust approach to plugins and core files. Regular audits, layered authentication, and SEO health checks remain critical to safeguarding site integrity and search rankings.

Fake WordPress Security Plugins Trigger Backdoor, SEO Poisoning

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence

How the Malware Operates: Infection Chain and Key Risks

Detection and Removal: Step-by-Step Mitigation Guide

Preventing Future Attacks: Hardening WordPress Security

148 Malicious npm Packages Used to Build a Browser Based DDoS Botnet

Pakistan Law Enforcement Agencies Targeted in Alleged Multi Group Cyber Espionage Operations