- Wordfence -Scientists reveal a new piece of WordPress -Malware
- Threat actors used AI to create legitimate looking tools
- Malware pretending to be an anti-malware product
Security researchers have discovered a piece of WordPress malware that pretends to be an antimalware solution. At the end of April, Marko Wotschka from the Wordfence team released a new blog post with details about an “interesting WordPress Malware”: It appears in the file system as a normal WordPress plugin, often named ‘WP-Antymalwary-Bot.php’.
While looking conspicuous at first, the researchers discovered that this plugin contains several features that allow attackers to continue on the target website, hide the plugin from the dashboard and externally perform code.
“Pinging functionality that can report back to a command and control (C&C) server is also included, as well as code that helps spread malware into other folders and injecting malicious JavaScript responsible for serving ads,” explained Wotschka.
Compromised hosting accounts
Wordfence first discovered the malicious plugin during a place in January 2025 when they discovered a modified ‘WP-Crron’ PHP file.
It created and programmatically activated malware, which also turned out to have used the names “addons.php”, “wpconsole.php”, “wp-prorvance-booster.phon” and “SCR.PHP”.
If the site’s admin deletes the plugin, recreates WP-Crron and reactivates it automatically.
Wordfence could not determine who the threat actors behind the attacks are or how they managed to compromise on these sites.
There were no logs to analyze why the researchers speculated that the infection happened either via a compromised hosting account or FTP credentials. They also succeeded in determining that the C2 server is located in Cyprus and that a similar attack was already seen back in June 2024.
Another thing that makes this malware interesting – as Wordfence put it – is the apparent use of generative artificial intelligence (AI) in code writing.
It is not the use of AI itself that is interesting, but rather the fact that AI helps threat actors to create “more legitimate to see malware”.
Via Bleeping computer
