WordPress Casino-Spam Malware Uses Hidden Payloads and Reinfection Mechanisms
Summary
A technical investigation of WordPress casino-spam malware found payloads hidden in the database and a .dat file, redundant execution code in theme and plugin files, and a separate script that restores removed infection code.
Key points
- Online casino spam has become the most common blackhat SEO spam variant detected by Sucuri’s SiteCheck tool, based on its own data.
- Attackers may hijack existing page URLs by adding directories containing casino spam and backlinks.
- In the investigated infection, code in the WordPress theme served spam on the “programs” path.
- The payload was stored in the WordPress database and a .dat file under wp-content/cache; if the database entry was missing, malware could fetch and restore content from an attacker-controlled domain.
- Duplicate execution code in a theme file and plugin provided redundancy, while another plugin script could restore removed code.
- Using database entries and non-standard file extensions can help spam evade scanners that focus on selected file types or do not inspect databases.
Article Details
- Attack Vectors
- Attackers compromise WordPress websites and add hidden casino backlinks to manipulate search rankings.
- Attackers hijack existing page paths by creating same-named directories containing spam-filled index.html files.
- Malicious PHP code checks for a database option and renders its content on the requested “programs” path; if the option is absent, it fetches replacement spam content from browsec[.]xyz and stores it in the database.
- The infection stores spam data in WordPress database options and a .dat file, duplicates execution code in theme and plugin files, and includes a separate reinfection mechanism that restores deleted code.
- Defensive Notes
- Remove attacker-added directories that replace legitimate page paths.
- Inspect WordPress theme and plugin PHP files for injected code, including the marker _wp_deferred_style_commit.
- Check the WordPress database, including wp_options, and non-standard files such as wp-content/cache/style.dat for concealed payloads.
- Review active plugins for reinfection code that can append the injected code back to theme and plugin files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | browsec[.]xyz | Attacker-controlled domain from which the infection retrieves replacement casino-spam content. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe payload is base64-decoded and concealed in database content and a .dat file to reduce its visibility.T1059.004 · Unix ShellThe attackers' PHP code executes on the compromised WordPress site to retrieve, store, and render spam content.T1505.003 · Web ShellInjected PHP code in WordPress theme and plugin files provides a server-side web shell-like mechanism that renders spam content and restores deleted code.
Products
ApacheThe reason for this is that Apache and Nginx environments resolve real filesystem paths first before they hand the URL over to the WordPress rewrite engine. The WordPress’ “pretty permalink” system is kind of just aGoogle Chrometo be a ripoff of the official .com website of a free VPN service available for download on the Google Chrome store. Whois records indicate that the .com domain was registered way back in 2012 while the .xyzNGINXThe reason for this is that Apache and Nginx environments resolve real filesystem paths first before they hand the URL over to the WordPress rewrite engine. The WordPress’ “pretty permalink” system is kind of just aWordPressimage of a conventionally attractive woman.Most often these spam infections (most often found on WordPress websites) are pretty straightforward to clean, but we recently came across some malware that put in some
Tools
Countries
Australiawriting spam – almost always in English, probably aimed at students in the Anglosphere: the UK, Canada, Australia, New Zealand, etc. The clear exception to that is Japanese spam that has always been so common, largelyCanadafor essay writing spam – almost always in English, probably aimed at students in the Anglosphere: the UK, Canada, Australia, New Zealand, etc. The clear exception to that is Japanese spam that has always been soIndonesiaultimately the house always wins. It’s worth mentioning that all forms of gambling are illegal in Indonesia; this certainly adds to the allure of online casinos there. More on that later.New Zealand– almost always in English, probably aimed at students in the Anglosphere: the UK, Canada, Australia, New Zealand, etc. The clear exception to that is Japanese spam that has always been so common, largely peddlingThailandmost importantly, several countries where we see a lot of this SEO spam geared towards (Indonesia, Thailand, Turkey, etc) have exceedingly strict local laws that pertain to gambling. In fact, Indonesia inTurkeyimportantly, several countries where we see a lot of this SEO spam geared towards (Indonesia, Thailand, Turkey, etc) have exceedingly strict local laws that pertain to gambling. In fact, Indonesia in particular has aUnited KingdomUnited Statespharma spam has always been primarily aimed at the English speaking world, most prominently the United States. The same goes for essay writing spam – almost always in English, probably aimed at students in the