Affected Systems
Nearly 2,000 WordPress websites compromised. All WordPress versions potentially affected depending on initial infection vector (likely vulnerable plugins, themes, or weak credentials). Campaign uses Steam Community profiles as covert command-and-control infrastructure.
Exploitation Status
Active campaign in progress. Approximately 2,000 WordPress sites confirmed infected. Malware is operational and using Steam Community profile comments to retrieve C2 instructions from threat actors.
Business Impact
Infected WordPress sites can be used for malicious activities including data theft, SEO spam, phishing redirects, or further malware distribution. The Steam-based C2 technique complicates detection since traffic to steamcommunity.com appears legitimate and is rarely blocked. Traditional network security controls may not flag this activity. Organizations hosting WordPress sites face reputational damage and potential blacklisting by search engines and security vendors.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit all WordPress installations for unauthorized files, users, and database changes; focus on wp-content/uploads and theme directories for webshells
- Review web server logs for suspicious POST requests and connections to steamcommunity.com domains from PHP processes
- Update all WordPress core installations, plugins, and themes to latest versions; remove unused or nulled plugins/themes
- Enforce strong admin credentials and implement two-factor authentication on all WordPress admin accounts
- Deploy file integrity monitoring on WordPress directories and consider web application firewalls with virtual patching capabilities