{"id":13335,"date":"2026-06-03T10:04:13","date_gmt":"2026-06-03T10:04:13","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/03\/wordpress-malware-abuses-steam-community-profiles-for-c2-operations\/"},"modified":"2026-06-03T10:04:13","modified_gmt":"2026-06-03T10:04:13","slug":"wordpress-malware-abuses-steam-community-profiles-for-c2-operations","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/03\/wordpress-malware-abuses-steam-community-profiles-for-c2-operations\/","title":{"rendered":"WordPress Malware Abuses Steam Community Profiles for C2 Operations"},"content":{"rendered":"

WordPress Malware Abuses Steam Community Profiles for C2 Operations
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A newly discovered malware campaign targeting WordPress websites has raised serious concerns across the web security community. <\/p>\n

Attackers behind this campaign are using an unexpected method to communicate with infected sites, hiding command instructions inside Steam Community profile comments and turning a popular gaming platform into a covert control channel.<\/a><\/p>\n

The malware works in two stages. First, it injects malicious JavaScript into the front end of a compromised WordPress website, serving harmful content to every visitor who lands on the page. <\/p>\n

Second, it plants a server-side backdoor that gives attackers persistent remote access, allowing them to modify WordPress plugin and theme files without any visible trace of the intrusion.<\/a><\/p>\n

GoDaddy security researchers identified this campaign, noting it was first detected in July 2024 and has since been found across approximately 1,900 WordPress sites.\u00a0<\/p>\n

GoDaddy\u00a0said in a report<\/a> shared with Cyber Security News (CSN) that threat actors are deliberately disguising their infrastructure behind Valve\u2019s trusted gaming platform rather than maintaining obviously malicious servers that could be flagged and taken down quickly.<\/a><\/p>\n

What makes this campaign particularly difficult to detect is how the malware conceals its payloads. It uses invisible Unicode characters, a technique known as steganography, to encode malicious data within Steam profile<\/a> comment text. <\/p>\n

Since those hidden characters look like completely normal text on the surface, traditional text-based scanning tools are far less likely to catch them during routine checks.<\/p>\n

\n
\"Example
Example of Steam commentthread_comment_text content (Source \u2013 GoDaddy)<\/figcaption><\/figure>\n<\/div>\n

The reach of this campaign is significant. Compromised websites unknowingly serve injected scripts to every visitor, exposing real users to potential harm. For site owners, the damage runs deeper, as the backdoor gives attackers the ability to rewrite site code even after partial cleanup attempts.<\/a><\/p>\n

WordPress Malware Abuses Steam Community Profiles<\/strong><\/h2>\n

The core of this attack relies on a PHP function embedded within the compromised WordPress installation. <\/p>\n

When any page on the infected site loads, the malware sends an HTTP request to a Steam Community<\/a> profile page using cURL, scrapes comment text from that profile, and decodes hidden payloads embedded inside it.<\/a><\/p>\n

The malware has been observed fetching profiles such as steamcommunity.com\/profiles\/76561199096946028 and caches extracted content using WordPress transients with a five-minute expiration window. <\/p>\n

\n
\"PublicWWW
PublicWWW results showing websites loading hello-mywordl[.]info (Source \u2013 GoDaddy)<\/figcaption><\/figure>\n<\/div>\n

The decoded data becomes a JavaScript URL injected into every front-end page via the wp_enqueue_script hook, under the deceptive handle name \u201casahi-jquery-min-bundle\u201d designed to mimic a legitimate library. <\/p>\n

The decoded external URL observed during analysis pointed to hello-myworld[.]info, which serves the final malicious JavaScript payload to site visitors.<\/a><\/p>\n

Stealthy Backdoor Enables Remote Code Execution<\/strong><\/h2>\n

The server-side component is just as dangerous as the front-end injection. A backdoor function registered through WordPress\u2019s template_redirect hook listens for POST requests containing specific authentication cookies. <\/p>\n

When those cookies are present, the backdoor either confirms it is active by returning a version string, or accepts base64-encoded PHP code and rewrites plugin and theme files across the entire WordPress installation.<\/a><\/p>\n

This remote code execution capability means that even if a site owner removes part of the infection, attackers can reinstall deleted code through the still-active backdoor. <\/p>\n

The malware protects this channel using AES-256-CTR encryption with PBKDF2 key derivation based on SHA-512 and 10,000 iterations, along with HMAC-SHA256 authentication to verify each incoming payload.<\/a><\/p>\n

To evade detection, the malware layers multiple obfuscation techniques<\/a>. All string constants are encoded using octal or hexadecimal escape sequences, function and variable names follow a randomized mixed-case hexadecimal style, and a disabled logging function is scattered through the code to mimic legitimate debugging infrastructure without ever executing.<\/a><\/p>\n

Site administrators who suspect an infection should enable maintenance mode right away and back up the compromised installation before making any changes. <\/p>\n

All WordPress credentials including admin passwords, database access, FTP credentials, and SSH keys must be rotated. Cleanup must cover every plugin and theme file, since partial removal is not enough given the backdoor\u2019s ability to remotely restore deleted code. <\/p>\n

Suspicious transient cache entries with the prefix\u00a0transient_caption<\/em>\u00a0and enqueued external scripts pointing to unknown domains should be removed.<\/a><\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/strong><\/th>\nIndicator<\/strong><\/th>\nDescription<\/strong><\/th>\n<\/tr>\n<\/thead>\n
URL<\/td>\nhttps:\/\/steamcommunity.com\/profiles\/76561199096946028\/<\/td>\nSteam profile used to host encoded C2 payloads<\/td>\n<\/tr>\n
URL<\/td>\nhttps:\/\/steamcommunity.com\/id\/ravypadliha<\/td>\nSteam profile observed during malware fetching<\/td>\n<\/tr>\n
URL<\/td>\nhttps:\/\/steamcommunity.com\/id\/enomisvool123\/<\/td>\nSteam profile observed during malware fetching<\/td>\n<\/tr>\n
URL<\/td>\nhttps:\/\/steamcommunity.com\/id\/eremohnf342<\/td>\nSteam profile observed during malware fetching<\/td>\n<\/tr>\n
Domain<\/td>\nhello-myworld[.]info<\/td>\nExternal domain serving the decoded malicious JavaScript payload<\/td>\n<\/tr>\n
Cookie Name<\/td>\nDEpjndDbNc<\/td>\nAuthentication cookie used to trigger backdoor ping\/keepalive response<\/td>\n<\/tr>\n
Cookie Name<\/td>\ntEcaKKXEsb<\/td>\nAuthentication cookie used to trigger remote code execution via backdoor<\/td>\n<\/tr>\n
File Path<\/td>\n\/wp-content\/themes\/gt3-child\/functions.php<\/td>\nFile path where malware was initially discovered<\/td>\n<\/tr>\n
Handle Name<\/td>\nasahi-jquery-min-bundle<\/td>\nDeceptive script handle name used to inject malicious JavaScript<\/td>\n<\/tr>\n
Transient Prefix<\/td>\ntransient_caption<\/em><\/td>\nWordPress transient cache prefix used to store C2 data<\/td>\n<\/tr>\n
Function Name<\/td>\nCe8d26cADf211699<\/td>\nPHP function responsible for fetching Steam profile content<\/td>\n<\/tr>\n
Function Name<\/td>\nEdF20922Ff709e68<\/td>\nPHP function performing cryptographic decoding of payloads<\/td>\n<\/tr>\n
Function Name<\/td>\nG7jp2L84mnVc4LNW9wcbZcaVFAyC9N72<\/td>\nPHP function injecting decoded script into WordPress front end<\/td>\n<\/tr>\n
Function Name<\/td>\nmpzZYIbGOb<\/td>\nPHP backdoor handler function registered via template_redirect<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong> Google<\/a><\/strong><\/strong>.<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n

The post WordPress Malware Abuses Steam Community Profiles for C2 Operations<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

WordPress Malware Abuses Steam Community Profiles for C2 Operations A newly discovered malware campaign targeting WordPress websites has raised serious concerns across the web security community. Attackers behind this campaign are using an unexpected method to communicate with infected sites, hiding command instructions inside Steam Community profile comments and turning a popular gaming platform into […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-13335","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13335"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13335"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13335\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13335"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13335"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13335"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}