Sophisticated Malware Exploits Ethereum Network to Compromise WordPress Websites

Security researchers have identified a complex malware strain called SC that targets WordPress sites by leveraging the Ethereum network for command-and-control operations, making it exceptionally difficult to remove. The malware embeds itself across multiple system layers including plugins, themes, and databases simultaneously, with the ability to regenerate if even one component remains infected. Attackers use approximately 20 public Ethereum RPC gateways to maintain resilience, allowing them to switch between access points if individual channels are blocked.

The SC malware represents a significant evolution in WordPress attack methodology. Rather than relying on traditional centralized command servers vulnerable to takedown, the attackers exploit the decentralized nature of blockchain infrastructure by distributing control across multiple Ethereum RPC endpoints. This approach transforms legitimate cryptocurrency network access points into unwitting facilitators of cybercrime, forcing defenders to balance security responses against disrupting valid blockchain operations.

The infection's resilience stems from its distributed architecture across eight or more system components—spanning database records, theme files, plugin code, and server configurations simultaneously. This redundancy means attackers can afford to lose several infection vectors while maintaining persistence, rendering standard removal tools inadequate and requiring comprehensive forensic cleanup across interconnected infrastructure layers.