EN PT-BR
← Voltar ao feed
high

TRUST#GRAFT JavaScript loader hijacks logged-in WordPress admin sessions to install persistent PHP backdoor plugin

1 fonte(s) · 1 atualização(ões) · publicado 26/10/2026 06:38 · coletado há 6 dias

Securonix Threat Research detailed TRUST#GRAFT, a JavaScript-to-WordPress attack chain that does not break WordPress authentication. It abuses the session of an already authenticated administrator's browser to install a persistent PHP backdoor disguised as the plugin Web Media Optimizer v2.1. Because the actions run through a browser that has already completed authentication, MFA offers limited protection. The initial delivery vector is unconfirmed, and the article cautions against treating hosting details as attribution.

Detalhes técnicos

  • The loader overlays a full-screen iframe styled as a Cloudflare "Just a moment" page with clipboard-write permission, a pattern consistent with ClickFix-style tradecraft.
  • It fingerprints the visitor (automation markers, WebGL renderer, canvas hashes, timezone, language), solves a small proof-of-work challenge and submits the data to its controller. This gating helps operators separate ordinary browsers from analysis tools.
  • It searches localStorage and sessionStorage for keys such as token, jwt, auth, api, secret, session, bearer and csrf, and posts matches plus up to 1,500 characters of document.cookie to a reporting endpoint. HttpOnly cookies are not readable this way.
  • If the visitor holds an administrator session, the script requests the plugin-upload page, extracts the WordPress nonce, downloads the staged ZIP wm.zip, posts it to update.php?action=upload-plugin, then fetches the plugins page and triggers activation. All requests use legitimate WordPress functionality.
  • The plugin injects remote JavaScript into public pages via wp_head, disables TLS verification when fetching its controller source, and hides itself from plugin lists, action links and update notices.
  • A hardcoded token gates two routes: one sets an authentication cookie for the first administrator account, the other replaces the remote script source.
  • For persistence, the plugin copies itself to wp-content/mu-plugins/wmedia-recovery.php. Must-use plugins load automatically and do not appear on the standard Plugins screen, so deleting the visible plugin directory leaves the backdoor active.
  • Loader candidates were identified on gerlace[.]com, vtevens[.]icu and caapman[.]me, and the /p/wm.zip path recurs across several domains.

Remediação

  • Correlate a single administrator session that reaches the upload page, uploads a ZIP and activates a plugin in close succession, and review audit logs for unexpected uploads or activations.
  • Inspect plugin directories directly on disk rather than through the admin console, and check wp-content/mu-plugins for wmedia-recovery.php.
  • Avoid using privileged wp-admin sessions for routine browsing and reauthenticate after a suspected browser compromise.
  • To confirm the first vector, gather the embedding page, HTTP referrers, redirect-chain evidence, web server logs, DNS and proxy telemetry, and CMS records showing when the script tag appeared.
  • Guard sensitive actions with current_user_can(), since WordPress nonces are CSRF protection and not an access control mechanism.

Linha do tempo

  1. gbhackers.com ↗ · pub. 26/10/2026 06:38 · coletado 26/10 07:00 primeiro registro

    TRUST#GRAFT JavaScript loader hijacks logged-in WordPress admin sessions to install persistent PHP backdoor plugin

    ler a análise desta fonte

    Securonix Threat Research detailed TRUST#GRAFT, a JavaScript-to-WordPress attack chain that does not break WordPress authentication. It abuses the session of an already authenticated administrator's browser to install a persistent PHP backdoor disguised as the plugin Web Media Optimizer v2.1. Because the actions run through a browser that has already completed authentication, MFA offers limited protection. The initial delivery vector is unconfirmed, and the article cautions against treating hosting details as attribution.

    Technical Details

    • The loader overlays a full-screen iframe styled as a Cloudflare "Just a moment" page with clipboard-write permission, a pattern consistent with ClickFix-style tradecraft.
    • It fingerprints the visitor (automation markers, WebGL renderer, canvas hashes, timezone, language), solves a small proof-of-work challenge and submits the data to its controller. This gating helps operators separate ordinary browsers from analysis tools.
    • It searches localStorage and sessionStorage for keys such as token, jwt, auth, api, secret, session, bearer and csrf, and posts matches plus up to 1,500 characters of document.cookie to a reporting endpoint. HttpOnly cookies are not readable this way.
    • If the visitor holds an administrator session, the script requests the plugin-upload page, extracts the WordPress nonce, downloads the staged ZIP wm.zip, posts it to update.php?action=upload-plugin, then fetches the plugins page and triggers activation. All requests use legitimate WordPress functionality.
    • The plugin injects remote JavaScript into public pages via wp_head, disables TLS verification when fetching its controller source, and hides itself from plugin lists, action links and update notices.
    • A hardcoded token gates two routes: one sets an authentication cookie for the first administrator account, the other replaces the remote script source.
    • For persistence, the plugin copies itself to wp-content/mu-plugins/wmedia-recovery.php. Must-use plugins load automatically and do not appear on the standard Plugins screen, so deleting the visible plugin directory leaves the backdoor active.
    • Loader candidates were identified on gerlace[.]com, vtevens[.]icu and caapman[.]me, and the /p/wm.zip path recurs across several domains.

    Remediation

    • Correlate a single administrator session that reaches the upload page, uploads a ZIP and activates a plugin in close succession, and review audit logs for unexpected uploads or activations.
    • Inspect plugin directories directly on disk rather than through the admin console, and check wp-content/mu-plugins for wmedia-recovery.php.
    • Avoid using privileged wp-admin sessions for routine browsing and reauthenticate after a suspected browser compromise.
    • To confirm the first vector, gather the embedding page, HTTP referrers, redirect-chain evidence, web server logs, DNS and proxy telemetry, and CMS records showing when the script tag appeared.
    • Guard sensitive actions with current_user_can(), since WordPress nonces are CSRF protection and not an access control mechanism.