WordPress administrators often leave their dashboards open while browsing other sites, posing a significant security threat. Recent research has uncovered a new exploit that leverages this common practice to infiltrate WordPress sites using a PHP backdoor.
JavaScript Loader Exploits Admin Sessions
Researchers have identified a JavaScript loader that activates when an admin visits a compromised page. This loader utilizes the browser session of a logged-in administrator to covertly install a hidden PHP backdoor on the site, circumventing the need for an admin password.
This method was notably used in a campaign that threatened over 1.2 million websites, highlighting the importance of vigilance among site owners. The malware activates only during active sessions, making detection via standard scans challenging.
The TRUST#GRAFT Attack Chain
Security experts Akshay Gaikwad and Aaron Beardslee from Securonix Threat Research have detailed this exploit, naming it TRUST#GRAFT. Their findings indicate that the JavaScript checks for an active admin session, utilizing it to inject malicious code without disrupting the WordPress login process.
The attack begins with a deceptive security check frame that mimics a Cloudflare verification screen, gathering data like screen size and plugin count while also detecting automated analysis tools. This data is sent to a control server to determine the next steps.
PHP Backdoor Concealed in Plugins
The exploit uses the admin session to access the WordPress plugin upload page, exploiting a security token to upload a malicious plugin disguised as a harmless tool. Named Web Media Optimizer, this plugin acts as a persistent backdoor, executing remote scripts and disabling security checks.
Upon activation, it copies itself to a directory loaded automatically by WordPress, remaining hidden from the standard plugin interface. This tactic underscores why merely removing visible plugins isn’t enough to secure a site.
To prevent such attacks, Securonix advises using separate browser profiles for admin duties, frequent credential updates, and monitoring for unauthorized PHP files. These steps, alongside thorough cleanup processes, can mitigate reinfection risks and protect against evolving cyber threats.
Indicators of compromise include various JavaScript loaders and ZIP files used in the attack, along with specific domain names and API paths involved in the exploit.
