TRUST#GRAFT : JavaScript-Compromised Sites Target WordPress Admin Browsers to Deploy a Persistent PHP Backdoor

TRUST#GRAFT is a multi-stage attack chain that compromises WordPress administrator browsers via JavaScript loaders presenting fake verification screens. It performs browser fingerprinting, credential harvesting from browser storage, and environment profiling. When an active WordPress admin session is detected, the attack extracts CSRF tokens to upload a malicious plugin named 'Web Media Optimizer.' This plugin installs a persistent PHP backdoor by copying itself into the must-use plugins directory, injects remote JavaScript into public-facing pages, and provides token-gated administrator access while concealing itself from plugin management interfaces. The attack does not require authentication bypass but exploits trusted browser sessions to convert legitimate admin workflows into compromise. The infrastructure is coordinated across multiple domains, indicating a sophisticated and targeted campaign.

The attack compromises authenticated WordPress administrator sessions to deploy persistent PHP backdoors, enabling unauthorized administrative access and control over the WordPress site. It can inject malicious JavaScript into public pages, potentially affecting site visitors and furthering compromise. The backdoor conceals itself from standard plugin management, making detection and removal difficult. This undermines site integrity, confidentiality, and availability by allowing persistent unauthorized access and manipulation.

No official patch or vendor advisory is provided for this threat. Mitigation should focus on detecting and removing the malicious 'Web Media Optimizer' plugin and any backdoors in the must-use plugins directory. Administrators should verify the integrity of installed plugins and monitor for unauthorized plugin uploads. Since the attack leverages authenticated sessions, enforcing strong session management, multi-factor authentication, and minimizing persistent login sessions can reduce risk. Regular backups and incident response readiness are recommended. Patch status is not yet confirmed — check vendor advisories for updates.