Filtered by category: Sucuri, tag: fake plugin × Clear
WordPress PBN Plugin Drops Dual Webshells via Database Injection
Matched: WordPress
A Turkish-speaking threat actor deployed a fake WordPress plugin that injects two PHP webshells directly into the database rather than the filesystem. The multi-stage attack uses a remote C2 server and hidden backlink injection to build a Private Blog Network for SEO monetization, likely serving gambling and adult affiliate schemes. Storing malware in the database helps evade traditional file-based security scans.