blog.sucuri.net

SC WordPress Malware Uses Self-Rebuilding Loaders and Blockchain-Controlled Backdoor

Researchers analyzed SC malware that keeps reinfecting WordPress sites through mutually restoring files, database copies, and shared memory. Its backdoor hides an admin account, disables security plugins, and retrieves instructions via public Ethereum RPC gateways.

Oct 1, 2026

WordPress PBN Plugin Deploys Database-Stored Web Shells

Incident responders found a WordPress infection combining a fake PBN plugin, a live command-and-control server, and two unauthenticated PHP web shells stored in the database, enabling unrestricted filesystem access.

Jun 16, 2026

Obfuscated PHP Backdoor Uses Remote C2 to Inject SEO Spam into Joomla Sites

Sucuri analyzed an obfuscated PHP backdoor in a compromised Joomla site. The loader contacts remote C2 servers to retrieve instructions that can redirect visitors or inject spam and other content.

Apr 16, 2026