Steam Community Profiles abused as C2 network in new WordPress malware infection campaign

• Malware hides payload in Steam Community comments
• WordPress sites used to host backdoors
• Nearly 2,000 sites compromised since July

Security researchers from GoDaddy found a cheeky new malware campaign that used comments made by Steam Community accounts as command-and-control (C2) infrastructure.

Here is how the attack plays out: The attackers would first find vulnerable WordPress websites, or those protected by weak credentials, and use them to host PHP malware somewhere in the site’s files. For example, the sample was found in a theme’s ‘functions.php’ file. This malware contains both a JavaScript injection component, and a server-side backdoor.

Then, whenever a visitor loads the infected website, the malware contacts one of several Steam Community profiles and downloads the contents of profile comments. On surface level, these comments look harmless (albeit incoherent), but they also contain invisible Unicode characters which carry the actual payload.

Industry support

“This encoding allows binary data to...

Copyright of this story solely belongs to techradar.com. To see the full text click HERE