WordPress Malware Comes Back After Removal Using a Self

Cybersecuritynews •Tushar Subhra Dutta • October 1, 2026

A WordPress backdoor is bringing deleted malware back within seconds, turning routine cleanup into a cycle of reinfection. Called SC, the infection spreads its working parts across website files, the database, and server memory, allowing surviving components to restore those removed. The investigation does not establish the original entry point or the number of affected […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Persistent SC WordPress Malware Uses Self-Healing Mechanisms A new strain of WordPress malware, dubbed SC, has been discovered to have self-repairing capabilities, making it extremely difficult to remove. Identified by the 'SC_' markers in its code, the malware spreads across at least eight locations, including files, the database, and shared memory. Each component can regenerate the others, allowing the backdoor to return within seconds of attempted removal. The malware utilizes a blockchain-controlled command-and-control mechanism, leveraging Ethereum infrastructure to maintain resilience against takedowns. It can also hide itself from admin screens, create hidden administrator accounts, and perform JavaScript injections. The complexity of its architecture poses significant challenges for cybersecurity professionals attempting to eradicate it. Current reports indicate that traditional cleanup methods are ineffective against this malware. 6 sources 69

WordPress Malware Comes Back After Removal Using a Self

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)