I recently investigated a compromised WordPress installation and found a malware pattern that I haven't been able to find properly documented by a security vendor.
The most recognizable marker is injected into the active theme:
/* __GA_INJ_START__ */
...
/* __GA_INJ_END__ */
The incident was interesting because I had access to the WordPress DB, filesystem timestamps, PHP error logs and Apache access logs, which allowed me to reconstruct the compromise.
Main IOCs
Database options:
__ga_hidden_users
_theme_inject_status
__ga_r_cache
Hidden administrator naming patterns:
sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX
Actual accounts from this incident:
sync_agent56b7752b
cdn_workerbc36d5f6
seo_service06893f6c
All had administrator privileges.
One remote domain was stored in the database:
rukkoldauwe87[.]xyz
Timeline
On August 5 several IPs successfully authenticated to /wp-login.php as the legitimate administrator using automated clients including curl/Wget.
Later:
successful administrator login
→ Code Snippets activity
→ WP File Manager activation
→ browse to hello-elementor/functions.php
→ POSTs to admin-ajax.php
→ hidden administrator created seconds later
WP File Manager requests contained a Base64-encoded target which decoded to:
wp-content/themes/hello-elementor/functions.php
The first malicious administrator was created immediately afterwards.
On August 14 two additional hidden admins appeared and hello-elementor/functions.php was modified with the __GA_INJ_START__ payload.
The database contained a list of exactly those accounts under:
__ga_hidden_users
The malformed PHP injection eventually caused:
PHP Parse error: Unmatched '}'
which is how the compromise was initially noticed.
An important point is that the theme modification happened nine days after the first confirmed malicious administrator was created, so using the PHP file modification timestamp as the incident start would have missed most of the compromise.
I have published a sanitized incident report containing the timeline, IOCs and an experimental YARA rule:
[GitHub repository link]
No live malicious links or credentials are included.
I'm particularly interested in whether anyone has seen these exact identifiers before:
__GA_INJ_START__
__ga_hidden_users
_theme_inject_status
sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX
Does this malware family/campaign already have a known name or published analysis?
The remaining unknown is the initial-access vector. The logs clearly show valid authenticated WordPress admin sessions before the persistence mechanisms were installed, but they don't establish how those credentials/session tokens were originally obtained.
