GoDaddy security researchers identified a malware campaign infecting about 1,980 WordPress sites that use Valve's Steam Community profile comments as a novel command-and-control infrastructure. The malware hides binary payloads within invisible Unicode characters embedded in Steam comments, which appear as ASCII art. These payloads instruct infected sites to load a malicious JavaScript file disguised as a legitimate library and install a backdoor that listens for authentication cookies in POST requests. The backdoor allows attackers to send base64-encoded PHP code to modify plugin and theme files, enabling persistent remote code execution and self-updating capabilities. The malware employs multiple layers of obfuscation, including octal/hex escape sequences and standard WordPress API calls, complicating detection. Infection vectors are not confirmed but likely include compromised credentials or vulnerable components. Indicators include outbound connections to Steam URLs, references to a suspicious domain (hello-mywordl[.]info), presence of invisible Unicode characters in PHP files, and specific cookie names in network traffic. Cleanup requires complete removal of all malicious code or restoration from a clean backup, as partial removal can be undone by the backdoor.

The malware enables attackers to maintain persistent remote code execution on infected WordPress sites by installing a backdoor capable of rewriting PHP code in plugins and themes. This persistence mechanism allows attackers to reinstate malicious components even after partial cleanup attempts. The use of Steam Community comments as a covert C2 channel complicates detection and attribution. The malicious JavaScript injection affects every frontend page, potentially impacting site visitors and site integrity. The infection compromises site security, potentially leading to data breaches, site defacement, or further malware distribution. The campaign affected nearly 2,000 WordPress sites, indicating a widespread impact.

No official patch or vendor advisory is provided. Remediation requires restoring infected sites from known-clean backups predating the infection whenever possible. If backups are unavailable or unreliable, manual cleanup must be thorough: remove all malicious code from plugin and theme files, clear suspicious WordPress transients from the database, verify no malicious scripts remain enqueued, and update WordPress core, plugins, and themes to their latest versions. Detection should focus on identifying outbound connections to Steam Community URLs, references to the malicious domain hello-mywordl[.]info, presence of invisible Unicode characters in PHP files, and POST requests containing specific cookie names (DEpjndDbNc or tEcaKKXEsb) or parameters (new_code). Partial cleanup is insufficient due to the backdoor's ability to reinstall removed components.