WordPress administrators are being cautioned about a newly discovered malicious plugin that masquerades as a benign caching tool, while covertly stealing admin login credentials.
During a routine malware scan, analysts found the plugin, deceptively named “wp-runtime-cache,” lurking in the wp-content/plugins directory of a compromised WordPress installation.
The plugin stood out from legitimate caching solutions by its lack of visible settings or management options in the wp-admin interface.
More importantly, it remained invisible in the list of installed plugins, suggesting deliberate concealment by its creators.
A closer inspection of the plugin directory revealed a single PHP file highly atypical for genuine caching plugins, which generally employ multiple PHP and JavaScript resources to provide rich functionality.
The single-file approach, often coupled with obfuscated code, is a hallmark of malicious WordPress plugins.
Credential Theft via Role-Based Triggers
Technical analysis of the plugin’s code revealed multiple warning signs: missing metadata (description, author, URL), use of randomized variable names, and heavy base64 encoding to obfuscate its operations.
While some commercial plugins use similar encoding for license protection, in this case, it was clearly masking malicious logic.
The core of the malware’s operation leverages WordPress’s hook architecture. The plugin registers a function to execute on every login attempt through the wp_login action hook.
This function inspects the credentials submitted and compares the user’s role against a list of high-privilege capabilities specifically, administrator (manage_options) and editor (edit_pages).
If the logged-in user matches the targeted roles, their username, password, and role data are exfiltrated to an external command-and-control (C2) server via an encoded URL: https[:]//woocommerce-check[.]com/report-to.
To avoid detection, further code ensures the plugin does not appear in the wp-admin plugins list for all users except those with a pre-generated hash linked to the attacker’s username and site URL, thus selectively hiding its presence from legitimate administrators.
Attack Infrastructure
The exfiltration endpoint domain was recently registered and displays mismatched registration details purporting to be based in Arkansas, USA, while listing a Hong Kong phone number.
Such tactics are common among threat actors seeking to evade detection and maintain operational infrastructure as older malicious domains are blacklisted.
According to Sucuri Blog Report, this attack once again highlights the imperative for administrators to regularly audit their plugin directories, monitor new file uploads, and routinely verify all active users and their privileges.
Security plugins and file integrity scanners can assist in identifying unauthorized changes, while enforcing two-factor authentication (2FA) or IP-based access restrictions can blunt the impact of stolen credentials.
Following a compromise, admins are strongly urged to not only update all user passwords but also to regenerate the cryptographic salts in wp-config.php.
These salts, easily generated via the official WordPress Salt Generator, ensure that even if hashed credentials are leaked, attackers cannot trivially derive the plain-text passwords.
This incident underscores the evolving sophistication of threats facing WordPress site operators and the necessity for continuous vigilance and robust incident response protocols.
Regular security reviews remain the best defense against such stealthy, high-risk malware campaigns.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Update
