TRUST#GRAFT Targets WordPress Admin Sessions to Install a Persistent PHP Backdoor
Summary
Securonix analyzed TRUST#GRAFT, a JavaScript loader that can use an already authenticated WordPress admin browser to upload a PHP backdoor with hidden must-use-plugin persistence; the initial delivery vector remains unconfirmed.
Key points
- The loader displays a fake verification screen, fingerprints the browser, and gates dynamic content; it can also retrieve a command and attempt to copy it to the clipboard.
- It searches browser storage and accessible cookie data for token-like values and sends selected material to a reporting endpoint.
- With an authenticated administrator session and plugin-install permissions, the script extracts a WordPress nonce, fetches a ZIP, uploads it through the standard plugin workflow, and attempts activation. The analysis does not establish a standalone authentication bypass.
- The ZIP contains a plugin disguised as Web Media Optimizer that injects remote JavaScript, hides from ordinary plugin views, and copies itself into the must-use plugins directory.
- Token-gated functions can set an authentication cookie for the first administrator account and change the remote script source; the plugin also disables TLS verification when retrieving its controller source.
- Securonix recommends separating WordPress administration from ordinary browsing, monitoring plugin uploads and must-use plugins, and removing both visible and hidden backdoor components during cleanup.
- The recovered artifacts establish the loader-to-plugin behavior, but not how the loader was first delivered; confirming that requires evidence such as referrers, server logs, or the original page source.
Article Details
- Attack Vectors
- A browser-side JavaScript loader displays a fake Cloudflare-style verification overlay, fingerprints the browser, and uses server-side gating before returning dynamic content; the initial delivery mechanism is unconfirmed.
- The loader can retrieve a command through an iframe and attempt to copy it to the clipboard as part of a ClickFix-style lure; the article does not confirm that a command was executed.
- The loader searches localStorage and sessionStorage for token-like values and collects accessible document.cookie content before posting the data to a reporting endpoint.
- When it finds an already authenticated WordPress administrator session with plugin installation rights, the loader extracts a WordPress nonce, uploads a staged ZIP through the normal plugin-upload workflow, and attempts activation.
- The installed Web Media Optimizer backdoor injects remote JavaScript into public pages, copies itself into mu-plugins for persistence, hides from ordinary plugin views, and includes token-gated administrator-access functionality.
- Defensive Notes
- Use a dedicated browser or profile for WordPress administration and avoid visiting unrelated public sites while logged in to wp-admin.
- Monitor WordPress plugin upload and activation activity, especially sequences involving the plugin upload page, update.php?action=upload-plugin, and plugin activation.
- Inspect wp-content/mu-plugins for unexpected PHP files, including wmedia-recovery.php, and check public pages, WordPress options, and transients for unfamiliar remote script URLs.
- During containment, remove both the visible plugin and any must-use plugin copy; preserve relevant evidence, rotate administrator credentials, invalidate sessions, and review accounts.
- Limit plugin-upload permissions, require approval for new installations, and consider CSP and script allowlists.
- Preserve referrer, redirect-chain, web-server, DNS, and proxy evidence to investigate the unresolved initial delivery mechanism.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 07955dcb5f4f80c90ede398879589f2e369eb2d84c4975d3c8adf08433783409 | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 0a3cb24e0d0c05b544a3e32affe3ea8a4ed87c0cc90e918c10b94d3b849d76fa | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 16f73adce28e3a33e98035a19721819ddac9cda130e6f1c337db6f8d8c2f95c6 | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 19d9335e66d9d519c9068994491b1a0f8734626b5328fca9723d942b7128bc9c | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 2747316171bb2816b68db308162b40a47c6ddf82779d5f460a194921eb60f32c | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 2cac894bf2cef2232247927e18acd35280065b576c5fa030b5fbad666db0afcc | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 2dfa9e708fdb92e5d36080065f978e33a692c0fe813a75be9c7cdff03be51b6e | Listed as a relevant SHA-256 indicator under the analyzed PHP files. |
| SHA256 | 2fa9c207981e05141162b9c5cf62a86bdc6593b3a6861968e4df58f49c47da0d | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 3b79b342a580dd09a5e3f907e475c3131f4005be59468a59905fc289e005806d | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 4659d9648275113f7f95735d170f27f10fd6d0a4e606c5b4f6e916ddc54924ed | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 765525c4fabd01383ca3dd330dd4f4fbc931bea0724c12f553df41b48a96ca82 | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 804349f8f087588b057e942f321ec2c0a677a0374e02d47f95d43196fc4cac0a | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 85515e25894cace49286581f9436bd2da429e05bd96d39fafe1c42fbcdfcd4e7 | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | 86d775c2d5cb459541cd2b0b967fac65ce20c60e483c71c9f7e108d5ad0bd564 | Listed as a relevant SHA-256 indicator under the analyzed PHP files. |
| SHA256 | 9215d17e5138cee498bb529e69b1cc7267305136535025e9b49fe173cf648720 | SHA-256 indicator listed for the wm.zip payload. |
| SHA256 | e98949a8370c5c3356a8e97f49a2f963a6126b917e1bc653890f8c79738c981d | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | eb5a6c895d24fd08e3bbd74d7a0ea02600d3b7574b9761efb2876b671e8ddd39 | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | eeb182444019802abb34668bd6efc7e947c1822e95c87f9a5b5288b4331400c8 | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| SHA256 | f110e20dce8361a31332faba49e29e6afd54f8bc4913841f9bdad3cbb66c14e3 | Listed as a relevant SHA-256 indicator among the analyzed JavaScript files. |
| URL | hxxp[:]//caapman[.]me/p/wm.zip | Second-stage WordPress plugin ZIP payload used after the loader attempts the administrator-session pivot. |
| URL | hxxps[:]//caapman[.]me/cse3g1jd.js | Identified as a browser-side JavaScript loader candidate; the original delivery path is unconfirmed. |
| URL | hxxps[:]//gerlace[.]com/0k2blyny.js | Identified as a browser-side JavaScript loader candidate; the original delivery path is unconfirmed. |
| URL | hxxps[:]//nutmann[.]club/p/wm.zip | Listed as a candidate location for the second-stage WordPress plugin ZIP payload. |
| URL | hxxps[:]//okuneva[.]sbs/p/wm.zip | Listed as a candidate location for the second-stage WordPress plugin ZIP payload. |
| URL | hxxps[:]//vilialobos[.]lol/ads.php | Default remote controller source URL used by the PHP backdoor to retrieve a script source. |
| URL | hxxps[:]//vtevens[.]icu/50w2ouvx.js | Identified as a browser-side JavaScript loader candidate; the original delivery path is unconfirmed. |
| URL | hxxps[:]//vtevens[.]icu/p/wm.zip | Second-stage WordPress plugin ZIP payload used after the loader attempts the administrator-session pivot. |
MITRE ATT&CK
T1036 · MasqueradingThe backdoor presents itself as the benign-sounding Web Media Optimizer plugin.T1059.007 · JavaScriptThe JavaScript loader fingerprints the browser, injects an iframe, handles clipboard logic, collects browser data, and attempts the WordPress session pivot.T1078 · Valid AccountsA token-gated backdoor path sets an authentication cookie for the first administrator account and redirects to wp-admin.T1102 · Web ServiceThe loader and installed plugin contact web endpoints for gated content, reporting, commands, and remote script-source retrieval.T1189 · Drive-by CompromiseThe report maps the loader to this technique: browser-side JavaScript executes after a page visit or script injection; the original delivery mechanism remains unconfirmed.T1505 · Server Software ComponentThe PHP backdoor operates as a WordPress plugin and copies itself into wp-content/mu-plugins for persistence.T1555.003 · Credentials from Web BrowsersThe loader searches localStorage, sessionStorage, and document.cookie for token-like or credential-related material.T1564 · Hide ArtifactsThe plugin removes its entry from normal plugin listings, action links, and update visibility.T1567 · Exfiltration Over Web ServiceThe loader posts collected browser-storage values and accessible cookie content to a reporting endpoint.