GoDaddy found malware on 1,980 WordPress sites using Steam as C2 infrastructure
Source Reddit Cybersecurity
Discussion
GoDaddy researchers discovered malware on approximately 1,980 WordPress sites that use the Steam gaming platform's community profile comments as a covert command-and-control (C2) channel. The malware encodes instructions using invisible Unicode characters embedded in seemingly innocuous ASCII art comments on Steam profiles. These instructions direct infected WordPress sites to load malicious JavaScript mimicking legitimate libraries and install a persistent backdoor. The backdoor listens for specific authentication cookies and can receive and execute base64-encoded PHP code to modify plugin and theme files, enabling attackers to maintain persistence even after partial cleanup. Initial infection vectors are unconfirmed but likely include stolen credentials or vulnerable plugins. Detection involves monitoring outbound connections to Steam URLs, suspicious script references, and specific cookie names in POST requests. Remediation requires full removal of all malicious components or restoration from a clean backup predating the infection.
r/cybersecurity (opens in a new tab)u/sunychoudhary0 points0 comments