A compromised Joomla website was found to contain heavily obfuscated PHP code injected at the top of the index.php file. This code functions as a remote loader backdoor that contacts command-and-control servers (cdn.erpsaz.com and cdn.saholerp.com) to send server fingerprint data and receive dynamic instructions. Based on these instructions, the malware can redirect visitors, inject spam content, or serve fake SEO pages to search engines, facilitating search engine manipulation and spam campaigns. The malware assembles strings from two-character chunks to evade signature-based detection and maintains persistent remote control without further local file modifications. This campaign is identified as a medium-severity threat with no known exploits in the wild and no vendor-provided patch or remediation.

The malware enables attackers to hijack visitors to compromised Joomla sites by redirecting them or injecting spam content, potentially damaging the site's reputation and search engine rankings. It also manipulates search engine indexing by serving fake SEO pages, which can degrade the site's visibility and trustworthiness. The obfuscation and remote control capabilities allow the malware to remain undetected for extended periods, complicating detection and cleanup efforts.

No official patch or remediation guidance is provided in the available data. Site owners should conduct thorough forensic analysis to identify and remove the injected obfuscated PHP code from index.php and other affected files. Monitoring for suspicious outbound connections to the identified C2 domains (cdn.erpsaz.com, cdn.saholerp.com) and blocking these at the network perimeter may help mitigate ongoing control. Regular integrity checks of Joomla core files and installed extensions, combined with timely application of Joomla security updates, are recommended to prevent reinfection. Patch status is not yet confirmed—check vendor advisories and security blogs for updates.