Hackers Abuse Compromised WordPress Sites to Deliver GULoader Through EtherHiding Chain

Gbhackers •Mayura Kathir • June 16, 2026

A sophisticated intrusion that abused compromised WordPress sites to deliver GULoader via an EtherHiding → ClickFix → UNC-chain. The real-world ClickFix incident produced convergent evidence from an ANY.RUN sandbox detonation and live EDR telemetry, revealing a complete, user-initiated attack path from a WordPress mu-plugin backdoor to a blocked rundll32.exe execution that attempted to load GULoader […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

WordPress Exploits: Dual Webshells and GULoader Delivery Chain Uncovered Recent investigations revealed two significant cybersecurity incidents involving compromised WordPress sites. The first incident involved a Turkish-speaking threat actor using a fake plugin to drop dual PHP web shells via database injection, targeting Private Blog Networks (PBNs) for SEO monetization. The second incident exploited WordPress mu-plugins to deliver GULoader malware through a complex EtherHiding chain. Both attacks highlight the vulnerabilities in WordPress, affecting numerous sites in the gambling and adult affiliate sectors. The campaigns are ongoing, with evidence of user-initiated attack paths and remote command-and-control capabilities. Security professionals are urged to monitor for signs of these threats and implement protective measures. 2 sources 70

Extracted Entities

Hackers Abuse Compromised WordPress Sites to Deliver GULoader Through EtherHiding Chain

The full story

Extracted Entities

Attack Types (1)

Campaigns (2)

Malware (1)

Platforms (1)