New Malware Attack Using Variable Functions and Cookies to Evade and Hide Their Malicious Scripts
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A sophisticated malware campaign targeting WordPress sites has emerged, utilizing PHP variable functions and cookie-based obfuscation to evade traditional security detection mechanisms.<\/p>\n
The attack represents an evolution in obfuscation techniques, where threat actors fragment malicious code across multiple HTTP cookies and dynamically reconstruct executable functions at runtime.<\/p>\n
This approach makes static analysis significantly more challenging, as the malicious intent remains hidden until all cookie components are assembled and executed.<\/p>\n
The malware has been detected over 30,000 times in September 2025 alone, demonstrating its widespread deployment and continued effectiveness against vulnerable websites.<\/p>\n
The attack vector primarily targets PHP-based web applications, particularly WordPress installations, by injecting backdoor scripts that accept commands through specially crafted cookies.<\/p>\n
Unlike traditional malware<\/a> that embeds complete malicious payloads within files, this campaign distributes function names and encoded parameters across numbered cookie indices.<\/p>\n Once deployed, the malware waits for specific cookie configurations before activating, requiring attackers to send precisely structured requests containing all necessary components.<\/p>\n This conditional execution serves dual purposes: evading automated security scans that may trigger the script without proper cookies, and preventing unauthorized access by other malicious actors who discover the backdoor.<\/p>\n Wordfence researchers identified<\/a> multiple variants of this malware family during routine incident response operations, adding samples to their threat intelligence database containing over 4.4 million unique malicious signatures.<\/p>\n The detection came through analysis of compromised sites where conventional signature-based scanning initially struggled to flag the heavily obfuscated<\/a> code.<\/p>\n Analysis revealed that while individual variants differ in implementation details, they share core characteristics including dense obfuscation, excessive array lookups, and deliberate cookie validation checks that act as authentication mechanisms for attackers.<\/p>\n The malware operates through a multi-stage execution chain that leverages PHP\u2019s variable function capability, where appending parentheses to any variable causes PHP to execute a function matching the variable\u2019s string value.<\/p>\n In examined samples, the script begins by storing the The malware then concatenates cookie values to reconstruct function names, such as combining cookies containing \u201cbase64_\u201d and \u201cdecode\u201d to form the complete The execution chain demonstrates sophisticated layering:-<\/p>\n This reconstructs Later variants employ string replacement techniques, transforming obfuscated strings like \u201cbasx649fxcofx\u201d into \u201cbase64_decode\u201d by replacing characters \u2018x\u2019, \u2018f\u2019, and \u20189\u2019 with \u2018e\u2019, \u2018d\u2019, and \u2018_\u2019 respectively.<\/p>\n This multi-layered approach defeats pattern-matching detection while maintaining full remote code execution<\/a> capabilities through serialized payloads delivered via cookie parameters.<\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post New Malware Attack Using Variable Functions and Cookies to Evade and Hide Their Malicious Scripts<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nTechnical Implementation and Code Execution Chain<\/strong><\/h2>\n
$_COOKIE<\/code> superglobal into a local variable and validating that exactly 11 cookies are present, with one containing the specific string \u201carray11\u201d.<\/p>\nbase64_decode<\/code> function name.<\/p>\n$locale[79] = $locale[79] . $locale[94];\n$locale[23] = $locale[79]($locale[23]);<\/code><\/pre>\nbase64_decode<\/code>, then decodes another cookie containing \u201cY3JlYXRlX2Z1bmN0aW9u\u201d to produce \u201ccreate_function\u201d. The malware subsequently uses create_function<\/code> with attacker-controlled parameters to generate arbitrary executable code.<\/p>\n