MalwarePublished 1 Jun 2026

WordPress malware campaign hides payloads in Steam profiles

Source Bleeping Computer

Description

Nearly 2,000 WordPress websites were infected with malware that relies on Steam Community profile comments to hide command-and-control (C2) data. [...]

Impact

The malware enables attackers to maintain persistent backdoor access to infected WordPress websites, allowing remote execution of arbitrary PHP code. This compromises the integrity and security of the affected sites, potentially leading to further malicious activities such as data theft, site defacement, or use in broader attack campaigns. The use of Steam profiles for command-and-control data obfuscates attacker infrastructure, complicating detection and mitigation efforts. Approximately 1,980 WordPress sites were affected as of the report date.

Defensive guidance

Site owners should prioritize restoring affected WordPress sites from known good backups created before the infection date. If restoration is not possible, a thorough manual cleaning is required to remove all malware components and backdoors, as attackers can reinstall malware if any part remains active. Monitoring for suspicious references to Steam Community URLs, unexpected external JavaScript injections, outbound connections to Steam, and POST requests containing the specific authentication cookie or new_code parameter can aid detection. Removing compromised credentials and updating all WordPress themes, plugins, and core software to the latest versions is recommended to reduce infection risk.

References

bleepingcomputer.com/news/security/wordpress-malware-campaign-hides-payloads-in-steam-profiles/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Jun 2026, 17:18 UTC

References

Community reviews

Related threats