Back Securityaffairs.Co

GoDaddy found malware on 1,980 WordPress sites using Steam as C2 infrastructure

Securityaffairs.Co •Pierluigi Paganini • June 2, 2026

Malware on approximately 2,000 WordPress sites hid C2 instructions in Steam profile using invisible Unicode. GoDaddy researchers spotted a command-and-control infrastructure for a malware campaign abusing Valve’s Steam gaming platform. The experts discovered malware on approximately 1,980 WordPress sites that fetches its instructions by reading Steam Community profile , where the actual payload is […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Campaign Targets 2,000 WordPress Sites via Steam Profiles A malware campaign has infected approximately 1,980 WordPress websites by hiding command-and-control data within Steam Community profiles. Discovered by GoDaddy Security in July 2025, the malware uses invisible Unicode characters to encode malicious payloads, allowing attackers to evade detection. The initial infection vector is unclear but may involve stolen admin credentials or exploiting vulnerabilities in themes or plugins. The malware fetches instructions from Steam profiles and injects malicious JavaScript into WordPress pages. Security experts recommend monitoring for suspicious activity related to Steam URLs and external JavaScript injections. Site owners are advised to restore from known good backups if compromised. The campaign highlights the innovative use of trusted platforms for malicious purposes. 6 sources 69

Extracted Entities

GoDaddy found malware on 1,980 WordPress sites using Steam as C2 infrastructure

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)