WordPress Backdoors Create Hidden Admin Accounts and Exfiltrate Credentials
Summary
An analysis of two malicious WordPress files found them creating and restoring a hidden administrator account, concealing the account and plugin, and sending credentials to an attacker-controlled server. The article lists indicators and cleanup steps.
Key points
- A fake “DebugMaster Pro” plugin created an administrator account named help and hid itself and the account from WordPress listings.
- The plugin sent account details and site information to an attacker-controlled endpoint.
- A root-level wp-user.php file recreated the help administrator account with an attacker-chosen password if it was deleted or altered.
- The plugin also injected external scripts for visitors and logged administrator IP addresses.
- Indicators include the two named files, unfamiliar administrator accounts, and accounts that reappear after removal.
- Recommended cleanup includes deleting the files, auditing administrator accounts, resetting credentials, updating WordPress components, and monitoring outbound traffic.
Article Details
- Attack Vectors
- Malicious WordPress files disguised as a plugin and a core file create or recreate administrator accounts to maintain unauthorized access.
- The disguised plugin hides itself from plugin listings, sends generated account credentials and site details to an attacker-controlled endpoint, and injects external scripts for visitors.
- Defensive Notes
- Remove the DebugMaster plugin directory and wp-user.php; audit and remove the help account and other suspicious administrators.
- Reset WordPress, FTP, hosting, and database passwords; update WordPress core, plugins, and themes.
- Monitor server logs and outgoing traffic for connections to unknown or suspicious domains.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//kickstar-xbloom[.]info/collect.php | Attacker-controlled endpoint used to receive generated administrator account details. |