Malware in WordPress: Hackers Exploit mu-Plugins to Hijack Images and Links

Cybercriminals are exploiting a little-known feature in WordPress known as “mu-plugins” to inject malicious code, enabling persistent access to infected sites. Their goal is to hijack site images, insert spam, and redirect visitors to fraudulent websites, all while remaining undetected.

What Are WordPress mu-Plugins?

Must-use plugins, or mu-plugins, reside in a special directory (wp-content/mu-plugins). Unlike regular plugins, they activate automatically and do not appear in the WordPress admin panel. This makes them an attractive hiding spot for malware, as site administrators may overlook them during security checks.

“This approach represents a concerning trend,” noted Sucuri researcher Puja Srivastava. “Mu-plugins do not appear in the standard WordPress plugin interface, making them less noticeable and easier for users to ignore during routine security checks.”

How Hackers Are Abusing mu-Plugins

Recent investigations by Sucuri uncovered three different types of malicious PHP scripts hidden in the mu-plugins directory:

1. redirect.php – Redirects visitors to external malicious websites, often disguised as fake browser updates to trick users into downloading malware.

2. index.php – Functions as a backdoor, allowing attackers to execute arbitrary code by pulling scripts from remote sources, such as GitHub.

3. custom-js-loader.php – Injects spam content, replaces all images on the site with explicit content, and hijacks outbound links to direct traffic to scam sites.

The redirect.php script even includes a function to detect whether a visitor is a bot, allowing attackers to exclude search engine crawlers and avoid detection by security tools.

Expanding Tactics: WordPress as a Malware Distribution Platform

Hackers are increasingly using compromised WordPress sites to distribute malware. One alarming tactic involves deceiving users into executing malicious PowerShell commands on their Windows machines by presenting fake Google reCAPTCHA or Cloudflare CAPTCHA prompts. This technique, known as ClickFix, is being used to spread the Lumma Stealer malware.

Another method involves injecting malicious JavaScript into hacked WordPress pages. These scripts can either redirect visitors to dangerous third-party domains or act as skimmers, stealing financial information entered on checkout pages.