{"id":302266,"date":"2025-05-10T05:28:00","date_gmt":"2025-05-10T12:28:00","guid":{"rendered":"https:\/\/sftarticles.wpenginepowered.com\/en\/?p=302266"},"modified":"2025-07-01T14:40:43","modified_gmt":"2025-07-01T21:40:43","slug":"this-plugin-targets-wordpress-sites-by-posing-as-a-security-tool-how-to-stay-safe","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/this-plugin-targets-wordpress-sites-by-posing-as-a-security-tool-how-to-stay-safe\/","title":{"rendered":"This plugin targets WordPress sites by posing as a security tool: How to stay safe"},"content":{"rendered":"\n

A new and sophisticated malware attack<\/strong> is compromising WordPress websites by disguising itself as a security plugin. Security experts at Wordfence recently uncovered this threat, which uses convincing names and hidden functionalities to avoid detection while gaining persistent control over infected websites.<\/p>\n\n\n\n

A deceptive plugin hiding in plain sight<\/h2>\n\n\n\n

The malicious tool, identified under names like \u201cWP-antymalwary-bot.php\u201d<\/strong>, mimics legitimate plugins and is programmed to hide itself from the WordPress dashboard. It includes functions to remotely execute code, reinfect deleted files<\/strong>, and even send signals to a Command & Control (C2) server hosted in Cyprus. The malware also injects malicious JavaScript into directories<\/strong> to display ads and spread further.<\/p>\n\n\n\n

Researchers believe that Generative AI was used to develop the malware<\/strong>, enhancing its ability to appear authentic. This marks a shift in how attackers use AI\u2014not just for automation, but to improve the legitimacy and stealth<\/strong> of their tools.<\/p>\n\n\n\n

Infection and persistence mechanisms<\/h2>\n\n\n\n

The malware was first spotted during a routine site cleanup, where a modified \u201cwp-cron\u201d file was reactivating the plugin<\/strong> automatically. Even after removal, the malware regenerates itself using aliases like \u201cwpconsole.php\u201d or \u201cwp-performance-booster.php\u201d. Investigators suspect the initial breach may have occurred through compromised hosting credentials or FTP access<\/strong>.<\/p>\n\n\n\n

Because of the lack of forensic logs<\/strong>, Wordfence could not trace the exact method of intrusion or identify the responsible attackers.<\/p>\n\n\n\n

How to protect your WordPress site<\/h2>\n\n\n\n

Website administrators should regularly audit their file systems<\/strong>, disable unnecessary cron jobs, and use a trusted security plugin with active monitoring. It’s also crucial to change all FTP and hosting credentials<\/strong> immediately upon any sign of compromise.<\/p>\n\n\n\n

Using AI against AI-powered threats<\/strong> may be the new norm, requiring admins to stay updated and vigilant.<\/p>\n","protected":false},"excerpt":{"rendered":"

A new and sophisticated malware attack is compromising WordPress websites by disguising itself as a security plugin. Security experts at Wordfence recently uncovered this threat, which uses convincing names and hidden functionalities to avoid detection while gaining persistent control over infected websites. A deceptive plugin hiding in plain sight The malicious tool, identified under names like \u201cWP-antymalwary-bot.php\u201d, mimics … Continue reading “This plugin targets WordPress sites by posing as a security tool: How to stay safe”<\/span><\/a><\/p>\n","protected":false},"author":9317,"featured_media":302267,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-302266","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t