Fake Security Plugin on WordPress Enables Remote Admin Access for Attackers

Cybersecurity researchers have uncovered a malicious campaign targeting WordPress sites using a fake security plugin, `WP-antymalwary-bot.php`, which grants attackers admin access and enables stealth reinfection and JavaScript ad fraud. The plugin camouflages itself while pinging to a command-and-control server, spreading malware, and injecting ads. Known variants include `addons.php` and `wpconsole.php`. The malware's rise since January 2025 suggests Russian involvement. Other incidents include fake font domains for card skimming and deceptive CAPTCHA verifications leading to Node.js-based backdoors, attributed to the Kongtuke traffic distribution system.