A few weeks ago a business owner moved their WordPress site to HyperPress. Routine migration, nothing unusual on the surface. During our onboarding review, our engineers found something that should make every site owner uncomfortable: the site was actively serving malware to its visitors, and the owner had no idea. Not because they were careless. Because the malware was specifically engineered so they would never see it.
The infection matched a campaign that GBHackers and Netskope Threat Labs have now documented across hundreds of compromised WordPress sites. It is one of the most sophisticated pieces of website malware we have handled, and it earns that description.
A Fake CAPTCHA With Nine Layers of Misdirection
Here is the chain, simplified. A rogue must-use plugin, named something like site-helper- followed by hex characters, loads automatically with the site and registers a browser Service Worker. That worker intercepts pages, strips security headers, and injects attacker JavaScript into what visitors see.
The injected code does not fetch its next stage from some server that can be reported and taken down. It reads the payload out of a smart contract on a public blockchain, a technique called EtherHiding. You cannot sinkhole a blockchain, and the attacker can update instructions without ever touching the compromised site again.
Visitors are then shown a counterfeit Google reCAPTCHA. Clicking the familiar checkbox silently copies a command to the clipboard and instructs the user to press Win+R and paste it, a social-engineering trick tracked as ClickFix. From there it is a cascade: a file pretending to be an MP3 that is really an application, a hidden scheduled task, PowerShell running encoded commands in memory, a loader fetched from a domain dressed up as Bitdefender infrastructure, and finally the Amatera stealer quietly harvesting browser passwords and system credentials from the visitor’s Windows machine.
Built to Hide From the One Person Who Could Stop It
The detail that stays with you: the malware deliberately excludes the site owner. It checks for /wp-admin, the WordPress login page, and the logged-in cookie, and serves those visitors a perfectly clean site. The person most likely to notice the compromise is the only person guaranteed never to see it.
That is exactly what happened to our client. They used their site constantly. They saw nothing, because they were never meant to.
Why Automated Scanners Could Not Isolate It
We will be straight with you, because honesty is worth more than marketing: this one initially got past our malware detection stack too, and it was built to. There is almost nothing durable to detect. The payload lives on a blockchain, not in site files. The execution is fileless, running in memory on the visitor’s machine, not the server. The on-site footprint is a small must-use plugin and a Service Worker with innocuous names, and the persistence lives in visitors’ browsers where no server-side scanner can reach.
Signature-based scanning is necessary, and every GillyTech server runs layered scanning continuously. But campaigns like this are engineered specifically to slip between signatures. What catches them is a human who knows what a WordPress install is supposed to look like and notices what does not belong. Our backend engineers have over 17 years of experience doing exactly that, and the anomalies in this site’s must-use plugins directory did not survive first contact with a manual review.
The Cleanup, Done Safely
Our engineers isolated and removed the rogue plugin and Service Worker registration, audited every JavaScript file and administrator account on the site, and rotated all credentials. Cleanup for this campaign has a nasty catch: the Service Worker persists in the browsers of past visitors even after the site is clean, so remediation also means serving replacement worker code and advising affected users to clear site data. All of it was handled during onboarding, before the site went live on HyperPress. The client’s visitors are no longer a delivery channel for credential theft.
Why No Other Client Was Ever at Risk
The question any reasonable person asks next: while an infected site sat on your infrastructure, what about everyone else? The answer is that nothing else was ever in danger, and that is by design rather than luck. Every account on our platform runs on an enterprise CloudLinux OS inside our own hosting architecture, where each site lives in its own isolated environment with its own resources and its own walled-off filesystem. A compromise inside one account physically cannot reach into a neighboring one, the same isolation that makes “noisy neighbor” resource problems impossible on our platform makes cross-account contamination impossible too.
This is the unglamorous half of security we keep writing about, from patch-day speed to AI-accelerated cybercrime: the architecture you choose before an incident decides how bad the incident is allowed to be.
What to Check on Your Own Site
- Look in
wp-content/mu-plugins. Must-use plugins load automatically and never appear in your normal plugins list. Anything namedsite-helper-with random characters is a red flag, but any file you cannot explain deserves scrutiny. - Check your site logged out and in a private window. This campaign shows its real face only to ordinary visitors. Browse your own site the way a stranger would, from another device if possible.
- Audit administrator accounts and rotate credentials if you find anything suspicious, and review recently modified JavaScript files.
- Treat any CAPTCHA or verification page that asks you to paste a command into Run, PowerShell, or a terminal as malicious. Real verification never works that way.
Our WordPress security guide covers the broader hardening picture, and the full indicators of compromise are in the Netskope and GBHackers write-ups linked above.
Wondering what is quietly living on your website right now? Every HyperPress migration includes the kind of hands-on security review that caught this infection, not just an automated scan. Schedule a call and we will take a proper look under the hood.
