Malware Campaign Targets 2,000 WordPress Sites via Steam Profiles

A malware campaign has infected approximately 1,980 WordPress websites by hiding command-and-control data within Steam Community profiles. Discovered by GoDaddy Security in July 2025, the malware uses invisible Unicode characters to encode malicious payloads, allowing attackers to evade detection. The initial infection vector is unclear but may involve stolen admin credentials or exploiting vulnerabilities in themes or plugins. The malware fetches instructions from Steam profiles and injects malicious JavaScript into WordPress pages. Security experts recommend monitoring for suspicious activity related to Steam URLs and external JavaScript injections. Site owners are advised to restore from known good backups if compromised. The campaign highlights the innovative use of trusted platforms for malicious purposes.

Key Points: • Nearly 2,000 WordPress sites infected with malware using Steam for command-and-control. • Malware encodes payloads using invisible Unicode characters to evade detection. • GoDaddy recommends monitoring for suspicious Steam URLs and restoring from backups.