WordPress Malware Uses Hidden Plugin and Blockchain C2 to Stay Undetected

A newly identified WordPress malware strain is using a hidden plugin, stolen administrator access, and a blockchain-based command channel to remain active on compromised websites. The threat is built to survive common cleanup efforts while quietly collecting sensitive data from affected servers. The malware is installed as a must-use plugin, a type of WordPress component that loads automatically with every request and does not appear in the normal Plugins page. This placement gives attackers a reliable foothold and makes the malicious code easier to conceal from site owners during routine checks. Researchers at Wordfence…