Threat reportMalwareTL-2026-4505
TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to Silently Install PHP Backdoor via Fake 'Web Media Optimizer' Plugin
TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to (TL-2026-4505), also tracked as TRUST#GRAFT, is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects WordPress WordPress sites with an administrator who has, maps to 13 MITRE ATT&CK techniques (T1036, T1059.007, T1071.001), and is covered by 9 detection rules and 34 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 34Indicators of compromise
Key facts for TL-2026-4505
- Threat ID
- TL-2026-4505
- Also known as
- TRUST#GRAFT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, news - media, ecommerce
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 34
Malware and tooling in TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to
Malware and tooling: Web Media Optimizer 2.1
How TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to works
TRUST#GRAFT is a JavaScript-to-WordPress attack chain in which a fake-Cloudflare-verification loader waits for a signed-in WordPress administrator, reuses their authenticated browser session to upload and activate a malicious 'Web Media Optimizer 2.1' plugin, and persists a PHP backdoor in wp-content/mu-plugins. Securonix Threat Research reports the campaign is unattributed and its initial JavaScript delivery mechanism is unresolved.
Securonix Threat Research (Akshay Gaikwad and Aaron Beardslee) documented TRUST#GRAFT, reported by Cyber Security News on 2026-10-27. The Securonix report itself carries no discovery or publication dates. The chain does not bypass WordPress authentication or exploit a CVE; it abuses an already-authenticated administrator's browser session. A JavaScript loader served from attacker domains (gerlace.com, vtevens.icu, caapman.me) displays a fake Cloudflare verification ('Just a moment') overlay that obscures the page. It collects a browser fingerprint (screen dimensions, WebGL renderer, canvas hash, automation markers, timezone, plugin count), performs a proof-of-work style gate by contacting a controller server, searches localStorage/sessionStorage for token-like values, attempts clipboard command delivery via the Clipboard API with a textarea fallback, and probes /wp-admin/ access. Seven loader samples (0k2blyny.js, j0ghlty4.js, 50w2ouvx.js, x9bpnmck.js, cse3g1jd.js, 9l56j7cg.js, 4oco7gwc.js) are catalogued, each with its own SHA-256.
Loader-side API paths on the infrastructure have distinct roles per Securonix: /api/v1/8e4c615 (token retrieval), /api/v1/f659473 (fingerprint submission), /api/v1/e81929c (command retrieval), /api/v1/6a38418 (credential collection) and /api/v1/76584c1 (event tracking).
If the visitor is a logged-in administrator with plugin-install rights, the script requests the plugin upload page (plugin-install.php?tab=upload) with the existing session cookies, extracts the WordPress nonce, downloads a staged wm.zip from a staging server (/p/wm.zip on caapman.me, vtevens.icu, nutmann.club or okuneva.sbs), uploads it through the standard update.php?action=upload-plugin endpoint, and activates it via plugins.php?action=activate. No password is needed because WordPress honors the existing privileged session.
The resulting plugin, 'Web Media Optimizer' v2.1 (installed to wp-content/plugins/web-media-optimizer/), injects remote JavaScript into public pages via the wp_head hook, stores controller configuration in WordPress options/transients (wm2_pref.*, wm2_u, wm2_src, wm2_hc, wm2_a), disables TLS certificate verification when fetching the remote script source, and hides itself from plugin and update lists through the all_plugins and plugin_action_links filters. It copies itself to wp-content/mu-plugins/wmedia-recovery.php (must-use plugins load automatically and are not shown in the normal plugin workflow), producing a self-restoring backdoor. A hardcoded token gates passwordless administrator access (the plugin calls wp_set_auth_cookie) and remote script-source updates. The default remote controller is https://vilialobos[.]lol/ads.php.
The true first delivery mechanism of the loader is explicitly unresolved in the Securonix report (candidates: compromised pages, injected WordPress content, malicious ads, compromised themes/plugins, redirect chains). The campaign is not attributed to any actor, and infrastructure alone does not establish geography or targeting. BeaconBeagle config searches for vilialobos.lol and caapman.me returned no C2 configuration matches.
MITRE ATT&CK techniques used in TL-2026-4505
Defense Evasion
T1036 Masquerading; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204.004 User Execution: Malicious Copy and Paste
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Persistence
T1078 Valid Accounts; T1505 Server Software Component
Discovery
T1082 System Information Discovery
Collection
T1185 Browser Session Hijacking
lateral-movement
T1550.004 Use Alternate Authentication Material: Web Session Cookie
Credential Access
T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Exfiltration
Affected products and versions in TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to
- WordPress — WordPress sites with an administrator who has plugin-installation rights and an active session
Vulnerable versions: Not version-specific; abuses legitimate authenticated administrator sessions
Remediation for TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to
Immediate actions
- Search wp-content/mu-plugins/ for wmedia-recovery.php and any unexpected PHP files; remove both the visible Web Media Optimizer plugin (wp-content/plugins/web-media-optimizer/) and the mu-plugins copy
- Invalidate all administrator sessions and rotate administrator credentials after suspected exposure
- Audit WordPress options and transients (wm2_pref.*, wm2_u, wm2_src, wm2_hc, wm2_a) for suspicious remote script URLs and remove injected script sources
- Review public pages for injected remote scripts
- Block the TRUST#GRAFT domains (caapman.me, vtevens.icu, gerlace.com, nutmann.club, okuneva.sbs, vilialobos.lol) at DNS/proxy
Workarounds
- Sign out of WordPress admin dashboards when not in use
- Consider DISALLOW_FILE_MODS in wp-config.php to prevent plugin installation from the dashboard
Longer-term hardening
- Use a separate browser profile for wp-admin access, isolated from general web browsing
- Limit plugin upload/install rights to essential administrators and add an approval workflow for plugin uploads
- Monitor file integrity of wp-content/mu-plugins/ and plugin directories
- Review self-restoring backdoor cases for complete cleanup of all persistence copies and remote script sources
Timeline of TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to
- Securonix reports no attribution and an unresolved initial delivery mechanism for the JavaScript; BeaconBeagle searches for vilialobos.lol and caapman.me returned no C2 config matches
- As reported: outbound POSTs to /api/v1/6a38418 are identified as credential collection; /api/v1/e81929c serves commands and /api/v1/76584c1 receives event tracking
- As reported: plugin injects remote JavaScript into public pages via wp_head from default controller vilialobos.lol/ads.php, with TLS verification disabled on fetch
- As reported: plugin copies itself to wp-content/mu-plugins/wmedia-recovery.php, hides from plugin lists via all_plugins/plugin_action_links filters and stores wm2_* options/transients
- As reported: loader downloads wm.zip from a /p/wm.zip staging server, uploads it via update.php?action=upload-plugin and activates Web Media Optimizer 2.1 via plugins.php
- As reported: loader reuses the administrator's session cookies to fetch the plugin upload page and extract the WordPress nonce, with no password required
- As reported: loader fingerprints the browser (screen, WebGL, canvas, timezone, plugin count, automation markers), retrieves a token via /api/v1/8e4c615, submits the fingerprint to /api/v1/f659473 and gates on a controller response
- As reported: JavaScript loaders from gerlace.com, vtevens.icu and caapman.me show a fake Cloudflare 'Just a moment' verification overlay on the compromised page
- Cyber Security News reports Securonix Threat Research findings on TRUST#GRAFT, a campaign abusing logged-in WordPress administrator sessions (the Securonix report itself carries no date)
Sources cited for TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to
- Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors
- Securonix: TRUST#GRAFT WordPress Admin PHP Backdoor
- WordPress Developer Handbook: Must Use Plugins
- WordPress Advanced Administration: Editing wp-config.php (DISALLOW_FILE_MODS)
- MITRE ATT&CK T1505 Server Software Component
- MITRE ATT&CK T1185 Browser Session Hijacking
- MITRE ATT&CK T1204.004 Malicious Copy and Paste
- MITRE ATT&CK T1550.004 Use Alternate Authentication Material: Web Session Cookie
Detection coverage for TL-2026-4505
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4505 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.