WordPress Malware Abuses Steam Community Profiles for C2 — Unicode Steganography, AES-256-CTR Payloads, Cookie-Auth PHP Backdoor + JS Injection (~1,980 Sites, GoDaddy) — Threadlinqs Intelligence
As of 2026-06-02, WordPress Malware Abuses Steam Community Profiles for C2 — Unicode Steganography, AES-256-CTR Payloads, Cookie-Auth PHP Backdoor + JS Injection (~1,980 Sites, GoDaddy) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0663 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
A WordPress malware campaign disclosed by GoDaddy Security (first detected July 2025, ~1,980 infected sites) hides AES-256-CTR-encrypted C2 instructions inside Steam Community profile comments using
GoDaddy Security disclosed an active WordPress compromise campaign that turns Valve's Steam Community platform into a resilient dead-drop command-and-control (C2) channel. Since first detection in July 2025, GoDaddy engineers have remediated the malware on approximately 1,980 WordPress installations. The campaign is notable for hiding C2 instructions in plain sight on a trusted, high-reputation third-party service, making outbound C2 traffic blend in with legitimate user activity and frustrating reputation- and domain-based blocking.
C2 RESOLUTION (Steam dead drop). On WordPress page load, the first-stage implant issues an outbound request to one of several attacker-controlled Steam Community profiles (e.g. /profiles/76561199096946028/ and the vanity IDs ravypadliha, enomisvool123, eremohin342) and scrapes the profile comment text. The comments appear benign — sometimes rendered as ASCII art — but carry a payload encoded with six invisible Unicode code points: U+200C (zero-width non-joiner), U+200D (zero-width joiner), U+2061 (function application), U+2062 (invisible times), U+2063 (invisible separator), and U+2064 (invisible plus). The decoder maps each character to a value 0-5, converts each to 2 bits, reassembles bytes, and applies a bitwise NOT. Decoded payloads are cached locally in WordPress transients under the _transient_caption_ prefix to reduce repeat scraping.
CRYPTOGRAPHY. The hidden payload is optionally protected with a well-engineered crypto stack: AES-256-CTR for confidentiality, PBKDF2-HMAC-SHA512 (10,000 iterations) for key derivation, and HMAC-SHA256 for integrity. The wire format is an 8-byte salt, followed by a 32-byte HMAC, followed by ciphertext; HMAC verification uses constant-time comparison (PHP hash_equals) to resist timing attacks. This is materially more disciplined than typical commodity WordPress malware and indicates a capable operator.
FRONT-END JAVASCRIPT INJECTION. The decoded instruction is used to construct a hello-mywordl[.]info URL that is enqueued into every front-end page via the WordPress wp_enqueue_scripts hook under the handle 'asahi-jquery-min-bundle'. The observed script (https://hello-mywordl[.]info/js/lodash.core.min.js) is disguised as a legitimate JavaScript library. This gives the operator arbitrary client-side code execution against every site visitor — usable for redirects, malvertising, skimming, or drive-by delivery.
SECOND-STAGE PHP BACKDOOR. For server-side persistence and control, the malware installs a cookie-authenticated PHP backdoor embedded in plugin/theme files (observed in /wp-content/themes/gt3-child/functions.php). A request carrying the DEpjndDbNc cookie returns a keepalive/version banner ('OK
V:1767964512', a Unix epoch ~2026-01-09 indicating ongoing sample versioning). A request carrying the tEcaKKXEsb cookie accepts base64-encoded PHP supplied in the POST parameter new_code and executes it, yielding full remote code execution. The backdoor locates its own code by searching plugin/theme directories for the unique function-name marker G7jp2L84mnVc4LNW9wcbZcaVFAyC9N72 and rewrites matching lines, enabling self-update and re-infection after partial cleanup.
INITIAL ACCESS (assessed, not confirmed). GoDaddy did not identify a single exploited CVE. The assessed entry vectors are stolen WordPress admin credentials, compromised FTP/SFTP access, exploitation of a vulnerable theme/plugin, or supply-chain compromise of a theme/plugin. No threat actor, nation-state, or named malware family has been attributed.
DEFENDER IMPACT. Because cleanup that leaves any backdoor component active allows the attacker to reinstall removed code, remediation must be complete: restore from a known-clean backup predating infection where possible, or fully remove all malicious code, purge the _transient_caption_ transients, rotate all credentials, and update core/plugins/themes. SOC value lies in detecting outbound WordPress-server connections to steamcommunity.com, references to he
Weaknesses (CWE)
CWE-506, CWE-912, CWE-94, CWE-79, CWE-285, CWE-829
Target sectors: web-hosting, small-business, e-commerce, media, general
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1190, T1078, T1195.002, T1059, T1059.007, T1505.003, T1027, T1027.013, T1140, T1102.001