Steam Community Profiles Used as C2 Channel in WordPress Malware Campaign

Threat actors are increasingly turning to trusted platforms to hide their malicious infrastructure. In a campaign initially detected in July 2025, attackers began using comments on Steam Community profiles as command-and-control channels to distribute WordPress malware.

GoDaddy Security researchers have identified this infection across approximately 1,980 WordPress sites.

Rather than hosting their own highly visible malicious servers, the attackers hide encoded payloads within ASCII art on Valve’s gaming platform. This strategy allows them to fly under the radar while maintaining persistent access to compromised websites.

The malware is particularly dangerous because it executes two primary functions simultaneously. First, it performs client-side JavaScript injection by fetching encoded URLs from Steam profiles and injecting them into WordPress pages.

Second, it deploys a server-side backdoor that provides cookie-authenticated remote access for modifying PHP files.

Because it relies on standard WordPress functions like wp_enqueue_script and set_transient, the malicious activity closely mimics legitimate plugin behavior.

Steam Profiles Power Malware

The infection process begins when WordPress page loads trigger legitimate-looking HTTP requests to specific Steam profiles using cURL. Once connected, the malware extracts hidden payloads from the comment text section of the Steam page.

The attackers employ invisible Unicode steganography to disguise this payload, using a sequence of six zero-width and invisible Unicode characters to encode binary data directly within seemingly harmless comments.

The malware scans the text, strips away visible decoy characters, maps invisible Unicode characters to numerical values, and reconstructs the binary payload.

In advanced variants, the payload is further secured using AES-256-CTR encryption, PBKDF2 key derivation, and HMAC-SHA256 authentication.

Once successfully decoded, the payload generates a URL pointing to an external domain, such as hello-myworld [.]info.

This URL is then injected into WordPress front-end pages as an external JavaScript file, intentionally named to mimic legitimate libraries like Lodash or jQuery.

To further complicate analysis, the malware heavily relies on code obfuscation techniques. All string constants use octal or hexadecimal escape sequences to prevent simple text searches from flagging suspicious URLs.

Furthermore, function and variable names use randomized, mixed-case formatting that appears completely random but remains consistent across different site infections.

According to GoDaddy research, the malware establishes a robust server-side backdoor for attackers. It hooks into the WordPress template_redirect action and listens for POST requests containing specific authentication cookies.

The cookie DEpjndDbNc serves as a ping to verify that the backdoor is operational and to return a version identifier. Meanwhile, the tEcaKKXEsb cookie allows the attackers to pass base64-encoded PHP code and execute remote code modifications.

This file-modification function recursively searches plugin and theme directories to replace existing malware code with updated versions.

This remote rewriting capability enables threat actors to maintain persistence even if a site administrator attempts a partial cleanup.

Since the malware does not rely on a specific zero-day exploit, initial infections are likely due to stolen administrative credentials, compromised SFTP access, or unpatched third-party plugins.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.