WordPress malware campaign hides payloads in Steam profiles

# WordPress Malware Campaign Weaponizes Steam Community Profiles to Hide Command-and-Control Infrastructure

## The Threat

A sophisticated malware campaign has infected nearly 2,000 WordPress websites with a cleverly disguised payload that leverages Valve's Steam Community platform as a proxy for command-and-control communications. The attack represents a notable shift in how threat actors are hiding malicious infrastructure—by exploiting legitimate, heavily-used platforms to avoid deploying their own servers and evade traditional security detection methods.

The campaign, which has been active since at least July 2025, was uncovered and analyzed by security researchers at GoDaddy. The innovation lies not in the malware itself, but in how the attackers hide and retrieve their malicious code: embedded within innocent-looking comments on Steam Community profile pages using invisible Unicode characters.

## Background and Context

GoDaddy security engineers have identified the malware on approximately 1,980 WordPress websites to date, though the actual scope may be larger given that many compromised sites may not have been detected. The campaign demonstrates how attackers continue to evolve their tactics to evade detection while maximizing their operational capability.

The initial infection vector remains unclear, but researchers assess that attackers likely gained access through one or more of the following:

The diversity of potential infection vectors underscores a critical vulnerability in the WordPress ecosystem: the reliance on third-party plugins and themes, many maintained by small teams or abandoned entirely, creates numerous attack surfaces for threat actors to exploit.

## How It Works: A Multi-Stage Attack

The malware operates through a carefully orchestrated multi-stage attack chain that blurs the line between legitimate platform activity and malicious infrastructure:

Stage One: Initial Infection

The first-stage malware is planted directly on compromised WordPress websites. This initial payload contains the logic to reach out to specific Steam Community profiles during normal page loads.

Stage Two: Payload Extraction

When a website visitor loads a page on the infected WordPress site, the malware quietly reaches out to hardcoded Steam Community profiles. It extracts text from what appear to be benign, innocent-looking comments—comments that contain no visible indication of malicious content.

Stage Three: Decoding

The extracted comments contain hidden Unicode characters interspersed within normal ASCII text. These invisible characters are invisible to human readers but carry encoded payload data. The malware's decoder ignores all visible characters and focuses exclusively on the invisible ones.

Stage Four: Command Injection

Once decoded, the payload constructs a URL pointing to a malicious domain (in this case, hello-mywordl[.]info) serving JavaScript code. This code is injected into every frontend page of the infected WordPress website, ensuring it affects all visitors.

Stage Five: Backdoor Installation

The injected JavaScript retrieves what appears to be a legitimate library (files named asahi-jquery-min-bundle or lodash.core.min.js), but instead contains backdoor code that responds to specially crafted POST requests.

## Technical Details: Invisible Unicode Steganography

The technical sophistication of this campaign lies in its abuse of Unicode steganography. The attackers use six specific invisible Unicode characters to encode their payload:

| Character | Unicode Code Point | Purpose |

|-----------|-------------------|---------|

| Zero-width non-joiner | U+200C | Binary encoding |

| Zero-width joiner | U+200D | Binary encoding |

| Function application | U+2061 | Binary encoding |

| Invisible times | U+2062 | Binary encoding |

| Invisible separator | U+2063 | Binary encoding |

| Invisible plus | U+2064 | Binary encoding |

The encoder maps each invisible character to a corresponding number, converts them to binary representation, and reconstructs bytes from the resulting binary stream. Visible characters serve as camouflage—they appear normal to human readers and automated text analysis tools, but the decoder completely ignores them.

This approach is elegant from an attacker's perspective: binary data is embedded within normal-looking text that passes most content filters and appears legitimate to casual inspection.

## Evasion and Persistence Tactics

GoDaddy researchers identified multiple layers of evasion employed by the malware:

This last point is significant: the backdoor doesn't respond to random requests. It only executes commands when a POST request includes the specific authentication cookie and the malicious code parameter, substantially reducing the risk of accidental discovery or detection by automated security systems.

## Implications for WordPress Site Owners

The prevalence of this campaign underscores several critical risks for WordPress users:

Widespread Attack Surface: With millions of WordPress sites running outdated or vulnerable plugins and themes, the platform remains an attractive target for mass-infection campaigns.

Silent Compromise: Infected sites may appear to function normally. Visitors may see no indication of compromise, and standard WordPress logs may show nothing unusual due to the malware's use of legitimate APIs.

Persistent Backdoor Access: Once installed, the backdoor remains active even if the initial infection vector is patched. The attackers maintain code execution on the website indefinitely unless the backdoor is explicitly removed.

Legitimate Platform Abuse: By using Steam Community profiles as C2 infrastructure, the attackers avoid maintaining visible malicious infrastructure, making law enforcement takedowns and ISP-level blocking significantly more difficult.

## Defense Recommendations

Organizations managing WordPress websites should implement the following defensive measures:

Immediate Actions:

Forensic Indicators:

Remediation Strategy:

---

## HackWire Analysis

This campaign reveals a sophisticated understanding of how defenders operate. By hiding C2 infrastructure within comments on a legitimate, heavily-monitored platform like Steam, the attackers solve multiple problems simultaneously: they avoid maintaining visible malicious infrastructure, reduce the risk of takedown, and ensure their C2 channel persists even if individual compromised sites are cleaned.

The use of invisible Unicode characters is not new in information security—steganography has existed for decades—but its application in WordPress malware represents an escalation in practical tradecraft. This technique will likely inspire copycat campaigns because it requires minimal adaptation and works against most content security policies that focus on visible content inspection.

What's particularly concerning is the attack's indiscriminate scale. With nearly 2,000 confirmed infections and an unclear infection vector, this suggests either a significant vulnerability in a widely-used plugin, compromised credentials at scale, or both. WordPress site owners cannot simply "patch and move on"—they must assume that if they're running a vulnerable plugin or using weak credentials, they may already be compromised.

The real lesson here is that WordPress remains fundamentally exposed not because of flaws in WordPress core, but because thousands of plugin developers operate with minimal security oversight, and many site owners don't prioritize timely updates or credential hygiene. Until that changes, campaigns like this will continue to thrive.

— HackWire Editorial

---

## Related Coverage