WordPress Malware Hides C2 Data in Steam Profile Comments
Summary
GoDaddy researchers found the campaign’s malware on about 1,980 WordPress sites. It hides C2 data in invisible Unicode characters in Steam comments to retrieve JavaScript and install a backdoor; the initial infection vector is unclear.
Key points
- GoDaddy researchers found the campaign on approximately 1,980 WordPress websites; it was first uncovered in July 2025.
- The initial infection vector is unknown; researchers suggest possibilities including stolen credentials, vulnerable themes or plugins, or a supply-chain compromise.
- Malware on infected sites extracts invisible Unicode characters from Steam Community comments to reconstruct a payload.
- The payload builds a URL to JavaScript hosted at hello-mywordl[.]info, which is injected into WordPress frontend pages.
- The final-stage backdoor accepts base64-encoded PHP in POST requests when a specific authentication cookie is present.
- Evasion methods include obfuscated strings, randomized function names, and use of standard WordPress APIs.
- GoDaddy recommends checking for suspicious Steam references and scripts, then restoring from a known-good backup or thoroughly removing the infection.
Article Details
- Attack Vectors
- The campaign infected WordPress websites; researchers said the initial access method is unclear and assessed that it could involve stolen administrator logins, compromised FTP/SFTP credentials, exploitation of a vulnerable theme or plugin, or a supply-chain compromise.
- First-stage malware retrieves comments from specific Steam Community profiles and decodes hidden payload data carried by invisible Unicode characters.
- The decoded data builds a URL for JavaScript hosted on hello-mywordl[.]info; the script is injected into WordPress frontend pages and disguised as a legitimate JavaScript library.
- A final-stage backdoor accepts base64-encoded PHP in POST requests when a specific authentication cookie is present.
- Defensive Notes
- Check for references to Steam Community URLs, suspicious external JavaScript injections, outbound connections from WordPress servers to Steam, and unexpected scripts loaded from domains such as hello-mywordl[.]info.
- Look for invisible Unicode characters, suspicious _transient_caption_ cache entries, disabled SSL verification in cURL requests, and POST requests containing the malware’s authentication cookie or the new_code parameter.
- Prioritize restoring from a known-good backup from before the infection. If that is not possible, thoroughly clean the site because remaining components may allow attackers to reinstall removed code through the backdoor.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hello-mywordl[.]info | Domain reported as hosting the malicious JavaScript payload injected into WordPress pages. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware conceals payload data with invisible Unicode characters and uses obfuscated strings, randomized function names, and other obfuscation.T1036 · MasqueradingRetrieved malware is disguised using filenames resembling legitimate JavaScript libraries.T1059.007 · JavaScriptThe campaign injects and loads malicious JavaScript on WordPress frontend pages.T1102.001 · Dead Drop ResolverThe malware retrieves concealed C2 data from comments on Steam Community profiles.T1140 · Deobfuscate/Decode Files or InformationThe first-stage malware maps invisible Unicode characters to values, reconstructs binary data, and decodes the concealed payload.T1505.003 · Web ShellA backdoor on infected WordPress sites accepts base64-encoded PHP through authenticated POST requests.
Products
Steam CommunityNearly 2,000 WordPress websites were infected with malware that hides command-and-control data inside Steam Community profile comments using invisible Unicode characters.WordPressNearly 2,000 WordPress websites were infected with malware that hides command-and-control data inside Steam Community profile comments using invisible Unicode characters.