Uncovering Hidden WordPress Malware in the Mu-Plugins Directory: An Emerging Threat

TL;DR

• Hidden Threat: Sucuri researchers identified malware in the mu-plugins directory of WordPress sites, used by attackers to evade detection.
• Impact: This malware can redirect users, execute arbitrary code, and inject spam, compromising site security and user experience.
• Mitigation: Regular security monitoring, file integrity checks, and web application firewalls (WAFs) are crucial to prevent such infections.

Uncovering Hidden WordPress Malware in the Mu-Plugins Directory

In a recent development, Sucuri researchers have spotted a concerning trend where threat actors are deploying WordPress malware in the mu-plugins directory to evade security checks¹. This directory is particularly vulnerable because must-use plugins auto-load without activation, making it an ideal hiding spot for backdoors and malicious code.

Understanding the Threat

The mu-plugins directory in WordPress is designed for must-use plugins, which are automatically loaded on every page load without needing activation or appearing in the standard plugin list. Attackers exploit this feature to maintain persistence and evade detection, as files placed here execute automatically and are not easily disabled from the WordPress admin panel. This makes it an ideal location for backdoors, allowing attackers to execute malicious code stealthily¹.

Methods of Attack

Obfuscated PHP and Hidden Payloads

Attackers use obfuscated PHP in the mu-plugins directory to execute hidden payloads from locations like /wp-content/uploads/2024/12/index.txt. They employ functions such as eval() to run arbitrary code stealthily. The script constructs a URL, sends requests to an external server, fetches content via file_get_contents() or cURL, modifies robots.txt, checks response markers, and pings sitemaps. This script can manipulate website behavior, evade detection, and facilitate redirections¹.

Malware Variants

Sucuri experts detailed two cases of malware hiding in the mu-plugins directory, each using different methods to compromise WordPress sites. The malware includes:

• Fake Update Redirect (redirect.php): This malware selectively redirects visitors to malicious sites while avoiding bots and admins to evade detection. Disguised as a WordPress function, it tricks users into executing malicious code, leading to data theft, backdoors, and further infections.
• Webshell (index.php): A sophisticated attack disguised as a plugin, using cURL to fetch and execute a remote PHP script. This allows attackers to inject new malware dynamically without altering the file, enabling persistent control and ongoing infections.
• Spam Injector (custom-js-loader.php): This JavaScript injector replaces site images with explicit content and hijacks links to open malicious popups. It ensures persistence in the mu-plugins folder, harming the site’s reputation and user experience while manipulating traffic for malicious purposes¹.

Indicators of Compromise

The presence of this malware can be identified by several obvious signs:

• Unusual Behavior: Unauthorized redirections of users to external malicious websites.
• Suspicious Files: Files with uncommon or misleading names appearing within the mu-plugins directory, often mimicking legitimate plugins.
• Resource Usage: Elevated server resource usage with no clear explanation.
• File Modifications: Unexpected file modifications or the inclusion of unauthorized code in critical directories².

Persistence and Impact

Attackers increasingly target the mu-plugins directory for persistence, as it auto-loads plugins without activation. This allows them to redirect traffic, maintain backdoor access, and inject spam for SEO manipulation, making it hard to detect and remove. The infections discovered by the researchers aim for monetization and persistence, with impacts ranging from SEO spam to severe security breaches¹.

Deployment Methods

Attackers may have deployed the malware through:

• Vulnerable Plugins/Themes: Exploiting known vulnerabilities in plugins or themes.
• Compromised Admin Credentials: Gaining unauthorized access through weak or stolen admin credentials.
• Poorly Secured Hosting: Exploiting vulnerabilities in the hosting environment to upload and execute malicious files¹.

Mitigation Strategies

The repeated abuse of the mu-plugins directory highlights the creativity and persistence of attackers in hiding malware deep within WordPress installations. Regular security monitoring, file integrity checks, and web application firewalls (WAFs) are essential in keeping such infections at bay¹.

Conclusion

The discovery of hidden WordPress malware in the mu-plugins directory underscores the need for vigilant security practices. Website administrators must stay alert to unusual behaviors and implement robust security measures to protect their sites from such sophisticated attacks.

Additional Resources

For further insights, check:

• Sucuri Blog
• WordPress Security Best Practices

References

1. Sucuri (2025, February). “Hidden Backdoors Uncovered in WordPress Malware Investigation”. Sucuri Blog. Retrieved 2025-03-28. ↩︎ ↩︎² ↩︎³ ↩︎⁴ ↩︎⁵ ↩︎⁶ ↩︎⁷

2. Sucuri (2025, March). “Hidden Malware Strikes Again: Mu-Plugins Under Attack”. Sucuri Blog. Retrieved 2025-03-28. ↩︎