A newly discovered cyberattack is targeting WordPress websites by using a plugin that pretends to improve security but actually opens a backdoor for criminals. This fake plugin secretly gives attackers full control of affected sites.
How the Infection Begins
Security researchers at Wordfence found this malware while cleaning an infected website earlier this year. They noticed that a key WordPress system file named ‘wp-cron.php’ had been tampered with. This edited file was creating and activating a hidden plugin on its own, without the website owner’s permission.
This plugin has appeared under various names such as:
• wp-antymalwary-bot.php
• addons.php
• wpconsole.php
• wp-performance-booster.php
• scr.php
Even if the plugin is deleted manually, the altered ‘wp-cron.php’ file automatically brings it back the next time someone visits the website. This allows the malicious code to keep coming back.
How Hackers Might Be Gaining Entry
It’s still not clear how the hackers are getting into these websites in the first place. Experts believe they may be using stolen login credentials for hosting accounts or file transfer services like FTP. Unfortunately, no server logs were available to confirm exactly how the breach happens.
What the Plugin Allows Attackers to Do
Once active, the plugin checks if it's running correctly and then silently gives the attacker admin-level control. By using a special hidden function, attackers can log in as an administrator without using the usual login page. All they need is a specific web address and a password to take over the site.
The plugin also opens a secret door (called an API route) that doesn’t require login access. This lets attackers do things like:
• Add harmful code into theme files
• Clear plugin cache data
• Carry out other hidden tasks via special web requests
In updated versions of the malware, the plugin can also add harmful JavaScript to the website’s code. This can be used to show spam, redirect users to risky websites, or collect data from site visitors.
What Site Owners Should Watch For
Website managers should check the ‘wp-cron.php’ file and their theme’s ‘header.php’ file for any unfamiliar edits. Also, log entries with keywords like “emergency_login” or “urlchange” should be seen as warning signs of a possible attack.
Regular monitoring and cleanup can help prevent these kinds of silent takeovers.
