A recent malware campaign targeting nearly 2,000 WordPress websites demonstrates a novel approach to command and control (C2) infrastructure: leveraging Valve’s Steam Community platform. This highlights the increasing creativity of attackers and the challenges of securing web applications in a complex threat landscape.
What Happened
Security researchers at GoDaddy discovered a campaign, active since July 2025, where compromised WordPress sites are using Steam profile comments to store and retrieve malicious code. The malware embeds a payload within seemingly benign text in Steam comments using six specific, invisible Unicode characters (U+200C, U+200D, U+2061, U+2062, U+2063, U+2064). This encoding allows binary data to be hidden in plain sight. The decoded payload constructs a URL (hello-mywordl[.]info) that serves JavaScript, injected into every frontend WordPress page, often disguised as legitimate library files (e.g., asahi-jquery-min-bundle, lodash.core.min.js). A backdoor is then implemented, activated by POST requests including a specific cookie (tEcaKKXEsb) and allowing execution of base64-encoded PHP code.
GoDaddy notes several evasion techniques employed, including obfuscated strings, randomized function names, disabled logging, and leveraging standard WordPress APIs to blend in with normal activity. The initial infection vector remains unclear, but possibilities include stolen admin credentials, compromised FTP/SFTP access, vulnerable themes or plugins, or supply chain compromises.
Why It Matters
This campaign is significant for several reasons. First, it demonstrates a shift in C2 infrastructure, moving away from dedicated servers to publicly available platforms like Steam. This makes detection more difficult as traffic blends with legitimate Steam Community activity. Second, the use of Unicode characters for steganography is a clever technique for evading traditional signature-based detection. Third, the malware's reliance on standard WordPress APIs and obfuscation techniques highlights the importance of robust code review and security monitoring.
For developers, this underscores the need for secure coding practices, regular security audits of themes and plugins, and strong authentication mechanisms. Website operators must prioritize regular backups and implement intrusion detection systems capable of identifying anomalous outbound connections and suspicious JavaScript injections. The use of a legitimate platform to host malicious code also presents challenges for security vendors and requires constant adaptation of detection methods.
What To Watch
It is currently unclear how widespread the initial infection vector is, and further research is needed to determine the specific vulnerabilities exploited. Monitoring for references to Steam Community URLs, suspicious JavaScript injections, and the malicious domain (hello-mywordl[.]info) is crucial. The effectiveness of this technique may prompt other attackers to adopt similar methods, potentially utilizing other publicly available platforms for C2 communications. Security teams should also watch for the specific Unicode characters used in the encoding scheme and incorporate them into detection rules. The researchers recommend restoring from backups predating the infection, or performing a thorough manual cleaning if backups are unavailable.