# TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to Silently Install PHP Backdoor via Fake 'Web Media Optimizer' Plugin

> TRUST#GRAFT is a JavaScript-to-WordPress attack chain in which a fake-Cloudflare-verification loader waits for a signed-in WordPress administrator, reuses their authenticated browser session to upload and activate a malicious 'Web Media Optimizer 2.1' plugin, and persists a PHP backdoor in wp-content/mu-plugins. Securonix Threat Research reports the campaign is unattributed and its initial JavaScript delivery mechanism is unresolved.

- **Published:** 2026-10-27T02:20:11Z
- **Last reviewed:** 2026-10-27T02:20:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4505
- **ID:** TL-2026-4505
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Securonix Threat Research (Akshay Gaikwad and Aaron Beardslee) documented TRUST#GRAFT, reported by Cyber Security News on 2026-10-27. The Securonix report itself carries no discovery or publication dates. The chain does not bypass WordPress authentication or exploit a CVE; it abuses an already-authenticated administrator's browser session. A JavaScript loader served from attacker domains (gerlace.com, vtevens.icu, caapman.me) displays a fake Cloudflare verification ('Just a moment') overlay that obscures the page. It collects a browser fingerprint (screen dimensions, WebGL renderer, canvas hash, automation markers, timezone, plugin count), performs a proof-of-work style gate by contacting a controller server, searches localStorage/sessionStorage for token-like values, attempts clipboard command delivery via the Clipboard API with a textarea fallback, and probes /wp-admin/ access. Seven loader samples (0k2blyny.js, j0ghlty4.js, 50w2ouvx.js, x9bpnmck.js, cse3g1jd.js, 9l56j7cg.js, 4oco7gwc.js) are catalogued, each with its own SHA-256.

Loader-side API paths on the infrastructure have distinct roles per Securonix: /api/v1/8e4c615 (token retrieval), /api/v1/f659473 (fingerprint submission), /api/v1/e81929c (command retrieval), /api/v1/6a38418 (credential collection) and /api/v1/76584c1 (event tracking).

If the visitor is a logged-in administrator with plugin-install rights, the script requests the plugin upload page (plugin-install.php?tab=upload) with the existing session cookies, extracts the WordPress nonce, downloads a staged wm.zip from a staging server (/p/wm.zip on caapman.me, vtevens.icu, nutmann.club or okuneva.sbs), uploads it through the standard update.php?action=upload-plugin endpoint, and activates it via plugins.php?action=activate. No password is needed because WordPress honors the existing privileged session.

The resulting plugin, 'Web Media Optimizer' v2.1 (installed to wp-content/plugins/web-media-optimizer/), injects remote JavaScript into public pages via the wp_head hook, stores controller configuration in WordPress options/transients (wm2_pref.*, wm2_u, wm2_src, wm2_hc, wm2_a), disables TLS certificate verification when fetching the remote script source, and hides itself from plugin and update lists through the all_plugins and plugin_action_links filters. It copies itself to wp-content/mu-plugins/wmedia-recovery.php (must-use plugins load automatically and are not shown in the normal plugin workflow), producing a self-restoring backdoor. A hardcoded token gates passwordless administrator access (the plugin calls wp_set_auth_cookie) and remote script-source updates. The default remote controller is https://vilialobos[.]lol/ads.php.

The true first delivery mechanism of the loader is explicitly unresolved in the Securonix report (candidates: compromised pages, injected WordPress content, malicious ads, compromised themes/plugins, redirect chains). The campaign is not attributed to any actor, and infrastructure alone does not establish geography or targeting. BeaconBeagle config searches for vilialobos.lol and caapman.me returned no C2 configuration matches.

## MITRE ATT&CK

- T1059.007 Command and Scripting Interpreter: JavaScript
- T1204.004 User Execution: Malicious Copy and Paste
- T1505 Server Software Component
- T1078 Valid Accounts
- T1036 Masquerading
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1082 System Information Discovery
- T1185 Browser Session Hijacking
- T1071.001 Application Layer Protocol: Web Protocols
- T1567 Exfiltration Over Web Service

## Sources

- [Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors](https://cybersecuritynews.com/logged-in-wordpress-admin-sessions/)
- [Securonix: TRUST#GRAFT WordPress Admin PHP Backdoor](https://www.securonix.com/blog/trust-graft-wordpress-admin-php-backdoor/)
- [WordPress Developer Handbook: Must Use Plugins](https://developer.wordpress.org/advanced-administration/plugins/mu-plugins/)
- [WordPress Advanced Administration: Editing wp-config.php (DISALLOW_FILE_MODS)](https://developer.wordpress.org/advanced-administration/wordpress/wp-config/)
- [MITRE ATT&CK T1505 Server Software Component](https://attack.mitre.org/techniques/T1505/)
- [MITRE ATT&CK T1185 Browser Session Hijacking](https://attack.mitre.org/techniques/T1185/)
- [MITRE ATT&CK T1204.004 Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK T1550.004 Use Alternate Authentication Material: Web Session Cookie](https://attack.mitre.org/techniques/T1550/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4505