WordPress sites targeted by malicious plugin disguised as security tool

• Wordfence researchers uncover a new piece of WordPress malware
• Threat actors used AI to create legitimate-looking tools
• The malware pretends to be an anti-malware product

Security researchers have discovered a piece of WordPress malware pretending to be an antimalware solution. In late April, Marko Wotschka from the Wordfence team published a new blog post detailing an “interesting WordPress malware”: it appears in the file system as a normal WordPress plugin, often with the name ‘WP-antymalwary-bot.php’.

While looking inconspicuous at first, the researchers discovered that this plugin contains several functions that allows attackers to persist on the target website, hide the plugin from the dashboard, and remotely execute code.