Nearly 2,000 WordPress websites infected with malware from a famous gaming platform
- Kamy Le
- Jun 4
- 3 min read
Instead of using traditional server systems that are easily blocked by security shields, a sophisticated cyber attack campaign has recently taken a completely different path: exploiting the Steam platform as a command-and-control (C2) channel to manipulate a massive number of websites running on the WordPress source code.
According to figures recorded by security experts at GoDaddy, the wave of attacks quietly approached and injected malware into approximately 1,900 to nearly 1,980 WordPress websites between mid-2024 and July 2025.
Sophisticated tactics turning Steam profiles into "covert command stations"
Normally, to control infected websites, attackers need a command center. However, in this campaign, the hacker group exploited the infrastructure of Valve (the parent company of Steam) itself to evade the scrutiny of security scanning tools.
The real difference lies in their method of attack. Attackers leave seemingly normal comments or ASCII art images on Steam community profiles. However, hidden within those text strings are control commands delivered via invisible Unicode characters.
Standard security scanning systems usually ignore these invisible characters. However, pre-infected WordPress websites will automatically access these Steam profile pages, extract the hidden characters, convert them into binary code, and decode them back into a malicious link leading to domains such as hello-myworld[.]info.
Perfect camouflage and the threat of a "backdoor"
To avoid detection, the downloaded malicious code masquerades under the names of legitimate JavaScript programming libraries, such as asahi-jquery-min-bundle or lodash.core.min.js.
More dangerously, the hackers also planted a backdoor operating directly on the server side. This secret entryway is designed to be extremely complex with multiple layers of encryption, obfuscating commands, scrambling function names, and generating code snippets that pretend to disable system logging features.
This backdoor allows attackers to maintain long-term access. It is programmed to only respond to data requests (POST) accompanied by a specific authentication cookie named tEcaKKXEsb. Once this barrier is bypassed, malicious PHP code will be pushed to deeply interfere with, edit, or completely alter the source files of plugins and themes on the website.
Thorough security recommendations for administrators
Due to the malware's high capability for camouflage and evasion, incomplete cleanup will cause the website to be quickly re-compromised. Experts recommend that administrators immediately implement the following measures:
System isolation: Put the website into maintenance mode as soon as any unusual signs are suspected to prevent the malware from continuing to spread or performing malicious actions against users.
Data handling: Conduct a full backup of the current system to serve the investigation. However, the most preferred safe option is to restore the website from a completely clean backup dating prior to the infection.
Credential changes: Simultaneously and immediately change all types of passwords, from website administrator accounts and database accounts to FTP and SSH connection accounts.
Deep source code review: Thoroughly inspect all theme and plugin files. In particular, delete suspicious items in the cache, especially components containing the prefix transient_caption.
In addition, the technical team needs to check system logs to detect other anomalies such as: unreasonable outbound connections from the WordPress server toward Steam, the disabling of SSL authentication in cURL requests, or the appearance of data requests containing the parameter new_code and the attacker's malicious cookie.
References: WhiteHat, BleepingComputer
Comments