Joomla SEO Spam Injector — Obfuscated PHP Backdoor Hijacking Site Visitors (php.spam-seo.joomla-injector.002) — Threadlinqs Intelligence
As of 2026-05-30, Joomla SEO Spam Injector — Obfuscated PHP Backdoor Hijacking Site Visitors (php.spam-seo.joomla-injector.002) is a high-severity malware threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-0385 · Severity: HIGH · CVSS: 8.1 · Status: ACTIVE · Category: MALWARE
Attribution: N/A · FINANCIAL
Active mass-compromise campaign against outdated Joomla (<5.X) installations deploys a heavily obfuscated PHP loader at the top of index.php. On every page load the backdoor exfiltrates $_SERVER data
TL-2026-0385 tracks an active Joomla compromise campaign documented by Sucuri on 2026-04-16 (Puja Srivastava). The attacker injects a small, heavily obfuscated PHP loader at the very top of the target site's index.php. The loader is structured across four functions — wffn() (bootstrap decoder), mpjy() (27-entry string lookup table), fotr() (traffic cop / cloaking engine), and joog() (HTTP requester and exfiltrator). All sensitive strings (function names explode, base64_decode, curl_exec, domain fragments, URL components, header names) are fragmented into two-character concatenations (for example 'BASE6' . '4_dec' . 'ODE') and/or stored as a tilde-delimited base64 blob decoded into a 27-index lookup table — defeating naive signature scanners that search for literal sinks or complete base64 strings.
On every page load the backdoor serializes data from the PHP $_SERVER superglobal (HTTP_HOST, REQUEST_URI, HTTP_USER_AGENT, REMOTE_ADDR, etc.), base64-encodes it, and issues a curl_exec() GET to http://cdn.erpsaz.com/admin.php?ua=<encoded_fingerprint>. If the primary returns an empty/non-200 response, the loader retries exactly once against http://cdn.saholerp.com/admin.php (a second flag prevents infinite recursion). A third domain, lashowroom.com, is fully decoded at index 25 of the string table but is never referenced by any URL-constructing index call — present as a decoy to waste analyst time.
The fotr() function then branches on the C2 response: (Mode 1) if the body starts with 'http' the loader issues header('Location: ' . $body) and exit()s, silently redirecting the visitor to an attacker-chosen URL; (Mode 2) if the body starts with '##', the prefix is stripped via substr($body, 2) and the remainder is echoed directly into the page, injecting arbitrary spam HTML (e.g. the spam product links reported by the original victim); (Mode 3) if the response length exceeds 90 characters and contains '</urlset>' the loader sets Content-type:text/xml and returns the body as a fake XML sitemap, otherwise if the body contains '<html' it serves the raw HTML — both modes designed to cloak responses to search-engine crawlers and inject keyword-stuffed pages for SEO poisoning.
Because all directives are delivered remotely and the local file footprint is a single obfuscated block, defenders often miss the infection during casual inspection. The same site can be redirecting end users one hour and feeding Google a fake sitemap the next — fully controlled by the C2 operator. This dynamic control makes the infection long-lived and hard to correlate with any one visible symptom. Root cause in every Sucuri case studied has been exploitation of known, patched vulnerabilities in Joomla core or third-party extensions on installations running branches older than 5.X (which is end-of-life).
C2 infrastructure resolves to 91.239.78.37 (AS6698 VIRTUALSYSTEMS, RIPE, Poland/Ukraine) for cdn.erpsaz.com and 195.26.86.16 (AS43641 SOLLUTIUM-NL, RIPE, Ukraine/Poland) for cdn.saholerp.com. Both parent zones (erpsaz.com, saholerp.com) use Cloudflare nameservers, masking origin at the DNS layer but revealing authoritative zones directly on the sub-CDN hostnames. Sucuri tracks the family under signature php.spam-seo.joomla-injector.002 (original signature lineage dates to 2019; this 2026 variant is the first with the fragmented-string + tilde-delimited-table obfuscation pattern).
Impact is financial and reputational: compromised domains push traffic and link equity to attacker-promoted products, search engines demote or de-index cloaked pages, browsers may flag the site via Safe Browsing, and ad fraud downstream is common. The backdoor does not itself include the spam content — it is a pure remote loader, so removal requires deleting the injected block from index.php, resetting all admin credentials, and completing a full integrity scan of every PHP file on the host to locate any secondary implants.
Weaknesses (CWE)
CWE-506, CWE-94, CWE-601, CWE-434, CWE-912
Target sectors: small-business, ecommerce, media, education, nonprofit, hospitality, professional-services
Target regions: Global, North America, Europe, Latin America, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1595, T1583, T1583, T1608, T1190, T1189, T1059, T1505, T1027, T1027