GoDaddy discovered

GoDaddy Security researchers have analyzed malware that uses an unconventional approach to command and control: encoding malicious payloads for WordPress within Steam Community profile . This technique allows threat actors to hide their infrastructure behind Valve's trusted gaming platform rather than maintaining obviously malicious servers.

The malware performs two primary functions:

The campaign was first detected by GoDaddy Security in July 2025, and researchers have detected the malware on approximately 1,980 WordPress sites. Analysis of the code sample and observed behavior forms the basis of this technical breakdown.

The malware implements two parallel attack chains:

The malware uses WordPress page loads to trigger HTTP requests to Steam Community profiles. The code uses cURL with the following configuration:

The malware has been observed fetching the following Steam profiles:

The extracted content is cached using WordPress transients with a 5-minute expiration.

After extracting the Steam text, the malware processes it through a decoder that handles two encoding methods: invisible Unicode steganography and optionally encrypted payloads.

The decoder uses six invisible Unicode characters to encode binary data:

After removing all visible decoy characters, the decoder is left with only the invisible Unicode sequence (the encoded payload). Depending on the sample, the decoded bytes may then be decrypted using the optional crypto routine described below.

The decoding process:

This encoding allows binary data to be embedded within normal-looking text. The visible characters serve as camouflage while the invisible characters carry the actual payload.

The malware includes code to handle encrypted payloads, though the encryption is optional:

The encryption implementation uses:

The decoded payload is used to construct a URL, which is then injected into WordPress pages:

The decoded URL observed during analysis: hxxps://hello-mywordl[.]info/js/lodash[.]core[.]min[.]js

The script is loaded on every WordPress frontend page via the wp_enqueue_scripts hook. The handle name "asahi-jquery-min-bundle" and filename "lodash.core.min.js" mimic legitimate JavaScript libraries.

The malware implements a backdoor that responds to POST requests containing specific authentication cookies.

When the DEpjndDbNc cookie is present, the backdoor responds with:

This provides a method to verify the backdoor is operational and retrieve a version identifier.

When the tEcaKKXEsb cookie is present, the backdoor accepts base64-encoded PHP code via POST parameter:

The marker string decodes to: G7jp2L84mnVc4LNW9wcbZcaVFAyC9N72 (the function name used for script injection).

The file modification function searches recursively through plugin and theme directories:

This mechanism allows attackers to:

The malware employs several obfuscation methods to evade detection:

All string constants use octal or hexadecimal escape sequences:

This prevents simple text searches from identifying suspicious strings like URLs or function names.

Function and variable names use mixed-case hexadecimal-style naming:

These names appear random but remain consistent across infections.

The malware includes a non-functional logging system:

The $enabled variable is hardcoded to false, ensuring the logging never executes. Calls to this function are scattered throughout the code:

Bb6621c281Bd67C7("Fetching content from URL: $url"); Bb6621c281Bd67C7("Caption cached under key: $cache_key");

This creates the appearance of debugging infrastructure without providing any functionality.

The malware uses standard WordPress functions throughout:

This mimics legitimate plugin behavior patterns, making behavioral detection more difficult.

The malware does not appear to exploit any specific version of WordPress, plugin, or theme vulnerability. The most likely infection methods are:

Security teams can identify this malware through several key indicators:

The malware was discovered in /wp-content/themes/gt3-child/functions.php but can appear in any PHP file.

File-based detection should focus on searching WordPress plugin and theme directories for references to steamcommunity.com, the presence of invisible Unicode character arrays (U+200C, U+200D, U+2061-U+2064), cryptographic functions like hash_pbkdf2 and openssl_decrypt with AES-256-CTR mode, and disabled SSL verification (CURLOPT_SSL_VERIFYPEER set to false).

Network monitoring should alert on outbound connections from WordPress servers to Steam Community, JavaScript loading from non-CDN domains like hello-mywordl[.]info, and POST requests containing the authentication. WordPress-specific indicators include suspicious transient cache entries with the _transient_caption_ prefix and enqueued scripts pointing to external URLs.

If an infection is detected, site administrators should first document the compromise by backing up the infected installation and preserving server access logs before making any changes. Enable maintenance mode to prevent visitor exposure to injected JavaScript. Update all credentials including WordPress admin accounts, database passwords, FTP/SFTP access, hosting control panel logins, and SSH keys. Review server logs for evidence of backdoor usage by searching for the authentication cookie names and POST parameters named new_code, which indicate active exploitation of the remote code execution capability.

Cleanup should prioritize restoration from a known-clean backup predating the infection whenever possible. If backups are unavailable or unreliable, manual remediation requires searching for and removing malicious code from all plugin and theme files, clearing suspicious WordPress transients from the database, verifying that no malicious scripts remain enqueued, and updating WordPress core along with all plugins and themes to current versions. The remote code rewriting capability means partial cleanup may be insufficient—attackers can reinstall removed code through the backdoor if any component remains active.

GoDaddy's website security solutions help protect against this type of malware through signature-based detection and automated scanning.

GoDaddy Security can:

This malware campaign demonstrates an unusual approach to command and control by leveraging Steam Community profiles and WordPress to host encoded payloads. The use of invisible Unicode steganography, combined with optional AES-256-CTR encryption, allows attackers to hide malicious data in plain sight on Valve's trusted platform.

The malware's two-stage operation (client-side JavaScript injection and server-side backdoor) provides both immediate visitor impact and long-term persistent access. The cookie-authenticated backdoor's ability to remotely rewrite code allows attackers to maintain access even after detection and partial cleanup.

Key technical characteristics:

GoDaddy Security continues to monitor this threat and updates detection signatures as new variants are identified. We have successfully detected and remediated infections across our customer base and continue to intelligence with the broader security community.