WordPress EtherHiding malware: how to check your site

You read that a new piece of WordPress malware hides as a plugin, gets its orders through the Ethereum blockchain, and stays out of sight in the dashboard. Now you are wondering whether your own site has it, and whether visitors are seeing something you never put there. The WordPress EtherHiding malware that Wordfence described this week is built to be quiet, so a normal look at your Plugins screen may show nothing unusual even on an infected site. That is unsettling, but it also tells you where to look instead. The signs it leaves behind are specific: a file in one particular folder, administrator accounts with a telltale name pattern, and four short entries in your database. You can check most of them yourself in about ten minutes, or with one message to your host. What you find decides whether you can relax or need a proper cleanup, and it is worth knowing which today.

You can check your site for EtherHiding malware in about ten minutes

The first look does not need special tools or a security background. It needs a private browser window, your WordPress user list, and either your hosting file manager or a short request to your host. Each step below matches a sign that Wordfence Threat Intelligence described in its research, so a hit on any of them means something specific. Work through them in order and write down what you see as you go.

Look at your site the way a visitor does

Open your site in a private window while logged out, ideally on a device you do not use for WordPress admin work. Visit the homepage, your contact page, your checkout if you have one, and a few inner pages. Watch for redirects to other sites, popups you did not add, unexpected downloads, pages asking visitors to "verify" something, or text that does not belong. Do not click any prompt you did not create. Injected code often shows itself only to visitors who are not logged in, which is why this view matters more than the one you see every day as an admin.

Compare your administrator list against the rogue name patterns

In WordPress, go to Users and filter by Administrator. Wordfence reports rogue accounts built from a fixed prefix plus six random characters: `admin_xxxxxx`, `adm_xxxxxx`, `administrator_xxxxxx` or `backup_xxxxxx`. Also note any administrator nobody on your team recognizes, and any recent password resets you did not request. Keep in mind that this sample can hide accounts from the dashboard, so a clean list is a good sign, not a final answer. Wordfence suggests checking the users table directly in the database, for example through phpMyAdmin in your hosting panel.

Ask for a look inside wp-content/mu-plugins

This folder holds "must-use" plugins. WordPress loads them automatically on every page, and they do not appear on the normal Plugins screen or switch on and off from it. Open your host's file manager, go to `wp-content/mu-plugins`, and list what is there. The folder may be empty or missing, and some hosts place their own files in it. What you are looking for is a file nobody can explain, especially one that claims to be a health check or reporting tool and contains long runs of scrambled code. If you cannot reach your files, send your host one line: "Please list every file in wp-content/mu-plugins on my site and tell me which ones you installed."

Check four database entries and the scheduled tasks

In phpMyAdmin, open the `wp_options` table (the prefix may differ on your site) and search the option_name column for exact matches to `src`, `bu`, `bp` and `ic`. According to the report, `src` held the malware's own PHP code, `bu` and `bp` a stored username and password, and `ic` administrator passwords captured in plain text at login. Wordfence also found unfamiliar custom cron schedules with random names such as `jf_7xc5bj9trbgji`. A security or cron-viewer plugin can list scheduled tasks if you are not comfortable reading the database.

Run a reputable malware scan and keep the result

Finish with a scan from a known security plugin or your host's scanner, and save or screenshot the result. Wordfence says it released a detection signature for this sample on June 23, 2026 to paid customers, with free users receiving it after its standard 30-day delay. A scan result is one piece of evidence. Put it next to what you found in the folder, the user list and the database before deciding anything.

A clean result on every line is good news, and it is also the limit of a ten-minute check. It lowers the odds that this implant is on your site. It does not prove the site is clean, because the sample was built to hide from the same views you just used.

Wordfence found the implant hiding as a must-use plugin

Wordfence says it came across the sample in mid-June 2026 while cleaning up a site, and published its analysis, "Inside a Malicious, Stealthy WordPress Must-Use Plugin," this week. The malware was dressed up as an automated health-check and reporting tool, with a believable author name and a link to a code repository. In Wordfence's words, "The malware was installed as a must-use plugin with several self-healing mechanisms in place in order to survive removal."

Once in place, it does several things at once. It hides from the standard plugin list, the must-use plugin view, update notices and Site Health. It creates new administrator accounts or takes over existing ones. It hooks into the WordPress login so it can record administrator passwords as they are typed. It keeps a backup copy of its own code in the database, so it can rebuild itself if the file is deleted. It can inject JavaScript into pages for visitors. And on shared hosting, it searches for other WordPress installations it can reach and writes a copy of itself into each one. A copy of the report republished on September 23 carries the same technical detail if the original page is slow to load.

If you searched for a "WordPress malware plugin" to find out which plugin to remove, the report does not give you one. It does not name any plugin from the WordPress.org plugin directory as malicious or compromised, and it does not say how the attackers got onto the sites in the first place. What it describes is an implant placed on a site that had already been broken into. So, the useful question for your site is whether someone got in, through an outdated component, a reused password or a hosting account, rather than whether you run a particular plugin.

EtherHiding uses the blockchain as an address book, not a hiding place for the malware

EtherHiding is a way of storing directions on a blockchain instead of on a server someone can take down. In this sample, the implant does not carry a fixed address for the server that sends it orders. Each time it needs one, it asks an Ethereum smart contract, a small program stored on the blockchain, and the contract returns encrypted details that point to ordinary web servers. Those servers receive stolen data and send instructions back.

Wordfence says the implant knows three contract addresses and 21 public gateways it can use to query them, choosing among them as it goes. If defenders block one server, the attackers update the contract and point the implant somewhere new. If one gateway is blocked, the implant uses another. The blockchain copy cannot be deleted the way a malicious web address can be reported and removed, which is what makes the technique attractive to attackers. The idea is not new with this sample; Bitquery's EtherHiding investigation documents earlier use, and security researchers have tied the approach to fake-update campaigns before.

For you as a site owner, the practical meaning is simple. Your website is not hosted on Ethereum, and the blockchain does not control your site. The malware itself sits in your files and your database, where it can be found and removed. The blockchain part only means that blocking the attacker's servers will not stop an infected site from finding new ones, so removal from the site is the fix.

A fake CAPTCHA on your site calls for the same check

Maybe you arrived here because a customer said your site asked them to "verify you are human," or told them to update their browser. Take that seriously and run the check above today. A prompt you did not add means some script is running on your pages, and this sample can inject JavaScript through `wp_footer` with whatever payload its operators choose.

What the report does not say is that this particular sample shows fake CAPTCHA or browser-update prompts. Those lures are well documented in other campaigns that also used blockchain tricks. The same prompt can also come from a different piece of malware, an advertising script, or a compromised third-party service your site loads. The prompt tells you to investigate; the folder, user list and database tell you what you are dealing with.

While you check, ask anyone who saw the prompt not to follow its instructions, and note which page it appeared on and when. That detail helps whoever cleans the site find the injected code faster.

Finding one sign means cleaning the whole site at once

If any line in the table came up positive, the instinct is to delete the strange file and move on. With this sample, that is the step most likely to leave you infected. The code has a backup copy in the database, it can recreate accounts, and it may have spread to other sites on the same hosting account. The order below keeps you from undoing your own work, and the WordPress.org guide for a hacked site follows the same logic.

Preserve a copy before you delete anything

Take a full backup of files and database, or ask your host for one, and label it as infected. It is evidence of what happened and when, and it lets a specialist trace how the attackers got in. Do not restore from it later.

Lock down administrator access and bring in your host

Limit who can log in to WordPress and the hosting panel while you work. Tell your host what you found. They can check whether other sites on your account are affected, look at their logs for unexpected changes or outgoing connections, and sometimes isolate the account. If you run more than one WordPress site on the same hosting plan, check every one of them.

Clean files, database, users and scheduled tasks together

Remove the implant file, the `src`, `bu`, `bp` and `ic` options, every rogue administrator, and the unfamiliar cron schedules in one pass, then scan again. Replace WordPress core, plugin and theme files with fresh copies from trusted sources rather than editing them by hand. If you restore a backup instead, test it first, because a backup taken after the infection carries the infection with it.

Change passwords from a clean device, after the cleanup

Because the sample captured administrator passwords at login, treat every WordPress password as known to the attacker. After the cleanup, from a device you trust, change WordPress, hosting, database, FTP and email passwords, plus any payment or API keys stored on the site. Changing passwords before the implant is gone only hands it the new ones. Our post on the first 24 hours after a website is hacked covers the wider steps, including telling customers when their data may be involved.

A cleanup like this is finished when a fresh scan is clean, the folder and database checks come back empty, and the site stays that way for weeks, not when the first file is gone. A partial cleanup followed by reinfection is exactly what this sample is built to cause.

Prevention comes down to fewer ways in

The report does not say how attackers reached the sites, so prevention means closing the usual doors rather than one known hole. WordPress.org's hardening guide covers the basics, and each item below removes a way in.

• Trusted sources only: Install plugins and themes from the WordPress.org directory or a known commercial vendor, and never use "nulled" copies of paid plugins.
• Fewer moving parts: Remove plugins, themes, old test installs and administrator accounts you no longer use.
• Updates on a schedule: Keep WordPress core, plugins and themes patched, and act quickly on security releases.
• Stronger logins: Use unique passwords, turn on two-factor login where you can, and give each person only the role they need.
• A separate everyday account: Do routine editing from an Editor account and keep Administrator for admin work.
• Backups off the host: Keep tested backups somewhere other than your hosting account.

A web application firewall helps by blocking known attack traffic, but it cannot remove an implant that is already installed, and scanning, file monitoring and logs cover the gaps between them. If a plugin warning is what usually prompts your updates, our post on what to do first after a WordPress plugin vulnerability warning sets out a simple routine.

You can do the first look yourself; an audit is for when evidence turns up

Nothing about this report means every WordPress site needs a paid cleanup. If your logged-out check was normal, your administrator list is clean, the mu-plugins folder holds nothing unexplained, the four options are absent and a scan is clear, keep your site updated and repeat the check after future security news.

Outside help earns its cost when you find a rogue account, an unexplained must-use file or the database options; when the site gets reinfected after a cleanup; when you cannot reach your server files; when you run several sites on one hosting account; or when customer or payment data may have been exposed. A security audit at that point looks at files, database, users, scheduled tasks, logs and backups together, finds how the attackers got in, and confirms the cleanup held. Whoever you hire should be able to show you the evidence they found and explain what they changed.

Frequently Asked Questions About wordpress etherhiding malware

What is EtherHiding?

EtherHiding is a technique where malware reads its directions from a blockchain smart contract instead of a fixed server address. In the WordPress sample Wordfence described, an Ethereum contract tells the implant which replaceable servers to contact for orders and where to send stolen data.

Which plugin carries the WordPress EtherHiding malware?

Wordfence does not name any WordPress.org plugin as malicious or compromised. The malware is its own fake must-use plugin, disguised as a health-check or reporting tool, placed on a site that attackers had already broken into.

Can this malware hide from my WordPress dashboard?

Yes. Wordfence says it hid from the standard plugin list, the must-use plugin view, update notices and Site Health, and it can hide administrator accounts. That is why the check looks at the mu-plugins folder and the database directly.

Does a fake CAPTCHA on my site mean I have this malware?

Not on its own. A prompt you did not add means a script is running on your pages and your site needs checking, but the report does not list fake CAPTCHA prompts as a confirmed symptom of this sample, and other malware or third-party scripts can cause them.

Will deleting the file in mu-plugins fix it?

Not by itself. The sample keeps a backup of its code in the database, can recreate administrator access, and can copy itself to other sites on shared hosting, so files, database options, users and scheduled tasks all need cleaning in one pass.

Should I change my passwords?

Yes, after the cleanup and from a device you trust. The implant records administrator passwords at login, so change WordPress, hosting, database, FTP and email passwords, plus any payment or API keys, once the malware is gone.

Wrapping Up

The WordPress EtherHiding malware hides in `wp-content/mu-plugins`, stays off the Plugins screen, creates hidden administrators and stores its code and captured passwords in four database options. A logged-out look at your site, a check of your administrator list, a look inside the mu-plugins folder and a search for `src`, `bu`, `bp` and `ic` will tell you a lot in ten minutes. The blockchain part only affects how the malware finds its servers; the fix still happens on your own site.

If your check comes back clean, keeping plugins, themes and core updated and removing what you do not use keeps the doors narrow. If it does not, cleaning everything in one pass and changing passwords afterward is what keeps the implant from coming back.

If you found something, or you cannot reach your files to look, Web Leveling can take it from there. Our website security audit checks files, database, users, scheduled tasks and backups together, traces how the attackers got in, and confirms the cleanup held. We work with small and medium businesses across the country and overseas. Tell us what your check turned up, and we will reply with the next steps for your site.

Terms