WordPress Malware Abuses Steam Profiles for C2, Evades Detection

Key Takeaways

• A novel WordPress malware campaign is leveraging legitimate Steam Community profiles to host its command-and-control (C2) infrastructure.
• The malware operates in two stages: injecting malicious JavaScript into front-end pages and installing a persistent server-side backdoor.
• Detected in July 2024, this sophisticated threat has compromised approximately 1,900 WordPress sites, using steganography and advanced obfuscation to evade detection.
• The backdoor enables remote code execution, allowing attackers to modify plugin and theme files and re-infect sites even after partial cleanup efforts.

Cybersecurity researchers have identified a sophisticated malware campaign targeting WordPress websites that employs a highly unusual method for its command-and-control (C2) communications: embedding instructions within legitimate Steam Community profiles. This innovative approach allows threat actors to exploit a trusted platform, significantly enhancing their ability to evade detection and maintain long-term persistence on compromised systems.

The attackers behind this operation are covertly transmitting command instructions by hiding them within comments on Steam Community profiles. This technique effectively transforms a widely used gaming platform into an encrypted channel for controlling infected WordPress sites, as detailed in a recent report by GoDaddy security researchers. The campaign, first observed in July 2024, has already impacted approximately 1,900 WordPress installations.

Multi-Stage Attack Chain

The malware executes its malicious activities in a two-pronged attack. Initially, it injects harmful JavaScript code into the front-end of a compromised WordPress website. This ensures that any visitor accessing the site is inadvertently served malicious content.

Concurrently, the malware establishes a server-side backdoor, granting the attackers persistent remote access. This backdoor allows them to modify WordPress plugin and theme files without leaving overt traces of their presence, complicating detection and removal efforts. GoDaddy’s report, shared with Cyber Security News (CSN), indicates that the threat actors deliberately utilize Valve’s reputable gaming platform to mask their infrastructure, making it more challenging for security solutions to flag and dismantle their operations compared to traditional malicious servers.

A primary reason for the campaign’s elusiveness is the malware’s clever method of concealing its payloads. It employs steganography, using invisible Unicode characters to encode malicious data directly within the text of Steam profile comments. Because these hidden characters appear as normal text, conventional text-based scanning tools are largely ineffective at identifying them during routine security checks.

The implications of this campaign are substantial. Compromised websites inadvertently distribute malicious scripts to their visitors, potentially exposing users to further harm. For website owners, the persistent backdoor poses a deeper threat, as it enables attackers to rewrite site code even after initial cleanup attempts, leading to re-infection.

WordPress Malware Abuses Steam Community Profiles

The core functionality of this attack relies on a PHP function embedded within the compromised WordPress environment. When any page on an infected site loads, this malware initiates an HTTP request to a predefined Steam Community profile page via cURL. It then scrapes comment text from that profile and decodes any hidden payloads embedded within it. An example profile observed fetching content is steamcommunity.com/profiles/76561199096946028.

The extracted content is cached using WordPress transients, which have a five-minute expiration window. The decoded data is then transformed into a JavaScript URL, which is injected into every front-end page through the wp_enqueue_script hook. This injection uses the deceptive handle name “asahi-jquery-min-bundle” to mimic a legitimate library. During analysis, the decoded external URL was found to point to hello-myworld[.]info, which then serves the final malicious JavaScript payload to unsuspecting site visitors.

Stealthy Backdoor Enables Remote Code Execution

The server-side backdoor component is as dangerous as the front-end injection. This backdoor function is registered via WordPress’s template_redirect hook and actively monitors for POST requests containing specific authentication cookies. If these cookies are present, the backdoor performs one of two actions: it either confirms its active status by returning a version string or accepts base64-encoded PHP code. Upon receiving malicious code, it proceeds to rewrite plugin and theme files across the entire WordPress installation.

This remote code execution capability is critical because it allows attackers to reinstall deleted code through the persistent backdoor, even if a site owner attempts to remove parts of the infection. To secure this command channel, the malware employs robust encryption: AES-256-CTR with PBKDF2 key derivation using SHA-512 and 10,000 iterations, complemented by HMAC-SHA256 authentication to verify the integrity of each incoming payload.

Further enhancing its stealth, the malware utilizes multiple layers of obfuscation. All string constants are encoded using octal or hexadecimal escape sequences, while function and variable names are randomized with a mixed-case hexadecimal style. Additionally, a disabled logging function is strategically placed throughout the code, mimicking legitimate debugging infrastructure without ever executing, further complicating analysis.

What You Should Do

• Immediately enable maintenance mode and create a full backup of the WordPress installation if an infection is suspected.
• Rotate all WordPress credentials, including admin passwords, database access, FTP credentials, and SSH keys.
• Perform a comprehensive cleanup of all plugin and theme files, as partial removal is insufficient due to the backdoor’s remote re-infection capabilities.
• Remove any suspicious transient cache entries with the prefix transient_caption.
• Identify and remove enqueued external scripts pointing to unknown or malicious domains, such as hello-myworld[.]info.
• Regularly audit Steam Community profiles mentioned in the IoCs for any changes or new malicious content.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.