In this week’s ThreatsDay roundup, The Hacker News highlighted Wordfence research on an unusual piece of WordPress malware: it installs as a must-use plugin with several self-healing mechanisms designed to survive removal. It uses “EtherHiding” — concealing the attacker’s server locations behind a smart contract on the Ethereum blockchain, making its command channel resilient to takedown. Once in, it can create hidden administrator accounts, harvest admin passwords, modify the site remotely, exfiltrate data, and spread to other WordPress installations on the same file system.
Infections at this level aren’t cleaned by deleting a file or two — they call for a full rebuild, credential rotation everywhere, and proper isolation between sites on shared servers. If multiple sites live on one server account, one infection can become many.
Prevention beats cleanup: our website care plans include malware scanning, hardening, and server isolation guidance so infections like this never take hold. Learn more at https://qamardigitalventuresllc.com/
Source: The Hacker News ThreatsDay / Wordfence (October 2026).
