# WordPress Malware Abuses Steam Community Profiles for C2 — Unicode Steganography, AES-256-CTR Payloads, Cookie-Auth PHP Backdoor + JS Injection (~1,980 Sites, GoDaddy)

> A WordPress malware campaign disclosed by GoDaddy Security (first detected July 2025, ~1,980 infected sites) hides AES-256-CTR-encrypted C2 instructions inside Steam Community profile comments using six invisible Unicode characters. Infected sites scrape attacker-controlled Steam profiles, decode the hidden payload to build a hello-mywordl[.]info URL, and inject attacker JavaScript into every front-end page. A second-stage cookie-authenticated PHP backdoor enables base64-encoded PHP RCE for persistence.

- **Published:** 2026-06-02T00:00:00Z
- **Last reviewed:** 2026-06-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0663
- **ID:** TL-2026-0663
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GoDaddy Security disclosed an active WordPress compromise campaign that turns Valve's Steam Community platform into a resilient dead-drop command-and-control (C2) channel. Since first detection in July 2025, GoDaddy engineers have remediated the malware on approximately 1,980 WordPress installations. The campaign is notable for hiding C2 instructions in plain sight on a trusted, high-reputation third-party service, making outbound C2 traffic blend in with legitimate user activity and frustrating reputation- and domain-based blocking.

C2 RESOLUTION (Steam dead drop). On WordPress page load, the first-stage implant issues an outbound request to one of several attacker-controlled Steam Community profiles (e.g. /profiles/76561199096946028/ and the vanity IDs ravypadliha, enomisvool123, eremohin342) and scrapes the profile comment text. The comments appear benign — sometimes rendered as ASCII art — but carry a payload encoded with six invisible Unicode code points: U+200C (zero-width non-joiner), U+200D (zero-width joiner), U+2061 (function application), U+2062 (invisible times), U+2063 (invisible separator), and U+2064 (invisible plus). The decoder maps each character to a value 0-5, converts each to 2 bits, reassembles bytes, and applies a bitwise NOT. Decoded payloads are cached locally in WordPress transients under the _transient_caption_ prefix to reduce repeat scraping.

CRYPTOGRAPHY. The hidden payload is optionally protected with a well-engineered crypto stack: AES-256-CTR for confidentiality, PBKDF2-HMAC-SHA512 (10,000 iterations) for key derivation, and HMAC-SHA256 for integrity. The wire format is an 8-byte salt, followed by a 32-byte HMAC, followed by ciphertext; HMAC verification uses constant-time comparison (PHP hash_equals) to resist timing attacks. This is materially more disciplined than typical commodity WordPress malware and indicates a capable operator.

FRONT-END JAVASCRIPT INJECTION. The decoded instruction is used to construct a hello-mywordl[.]info URL that is enqueued into every front-end page via the WordPress wp_enqueue_scripts hook under the handle 'asahi-jquery-min-bundle'. The observed script (https://hello-mywordl[.]info/js/lodash.core.min.js) is disguised as a legitimate JavaScript library. This gives the operator arbitrary client-side code execution against every site visitor — usable for redirects, malvertising, skimming, or drive-by delivery.

SECOND-STAGE PHP BACKDOOR. For server-side persistence and control, the malware installs a cookie-authenticated PHP backdoor embedded in plugin/theme files (observed in /wp-content/themes/gt3-child/functions.php). A request carrying the DEpjndDbNc cookie returns a keepalive/version banner ('OK\nV:1767964512', a Unix epoch ~2026-01-09 indicating ongoing sample versioning). A request carrying the tEcaKKXEsb cookie accepts base64-encoded PHP supplied in the POST parameter new_code and executes it, yielding full remote code execution. The backdoor locates its own code by searching plugin/theme directories for the unique function-name marker G7jp2L84mnVc4LNW9wcbZcaVFAyC9N72 and rewrites matching lines, enabling self-update and re-infection after partial cleanup.

INITIAL ACCESS (assessed, not confirmed). GoDaddy did not identify a single exploited CVE. The assessed entry vectors are stolen WordPress admin credentials, compromised FTP/SFTP access, exploitation of a vulnerable theme/plugin, or supply-chain compromise of a theme/plugin. No threat actor, nation-state, or named malware family has been attributed.

DEFENDER IMPACT. Because cleanup that leaves any backdoor component active allows the attacker to reinstall removed code, remediation must be complete: restore from a known-clean backup predating infection where possible, or fully remove all malicious code, purge the _transient_caption_ transients, rotate all credentials, and update core/plugins/themes. SOC value lies in detecting outbound WordPress-server connections to steamcommunity.com, references to hello-mywordl[.]info, the unique marker string, and the two authentication cookies.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059 Command and Scripting Interpreter
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1505.003 Server Software Component: Web Shell
- T1027 Obfuscated Files or Information
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1102.001 Web Service: Dead Drop Resolver
- T1001.002 Data Obfuscation: Steganography
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1659 Content Injection

## Sources

- [Malware Targeting WordPress Abuses Steam Community Profiles for Command & Control Operations](https://www.godaddy.com/resources/news/malware-targeting-wordpress-abuses-steam-community-profiles)
- [WordPress malware campaign hides payloads in Steam profiles](https://www.bleepingcomputer.com/news/security/wordpress-malware-campaign-hides-payloads-in-steam-profiles/)
- [GoDaddy found malware on 1,980 WordPress sites using Steam as C2 infrastructure](https://securityaffairs.com/192990/cyber-crime/godaddy-found-malware-on-1980-wordpress-sites-using-steam-as-c2-infrastructure.html)
- [New WordPress Malware Uses Steam Profile Comments to Hide C2 Instructions](https://hackread.com/wordpress-malware-steam-profile-comments-instructions/)
- [Malware hides in Steam comments to infect WordPress sites](https://www.scworld.com/brief/malware-hides-in-steam-comments-to-infect-wordpress-sites)
- [Steam C2 WordPress Malware: Backdoor Cleanup Checklist](https://blog.gridinsoft.com/steam-c2-wordpress-malware-backdoor/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0663