In recent months, a concerning trend has emerged where threat actors are targeting the “mu-plugins” directory in WordPress installations. This tactic allows hackers to hide malicious code that facilitates remote site access and redirects unsuspecting visitors to fraudulent websites.
Understanding mu-Plugins
Must-use plugins, or mu-plugins, are special plugins placed in the wp-content/mu-plugins directory. Unlike standard plugins, mu-plugins are activated by default, eliminating the need for site admins to enable them manually. This inherent feature makes the directory a prime location for malware deployment.
The Threat Landscape
According to Puja Srivastava from Sucuri, “This approach is dangerous because mu-plugins don’t appear in the standard WordPress plugin interface, making them easy to overlook during routine security checks.”
Identifying the Malicious Codes
Recent analyses have revealed three primary types of rogue PHP scripts found within this directory:
Manipulative Techniques
The redirect.php file uses social engineering tactics by masquerading as a browser update, tricking users into installing malware that can exfiltrate sensitive data or deploy additional threats.
In response to these threats, Sucuri outlined a chilling scenario where compromised WordPress sites serve as platforms for executing disconnect scripts that interact closely with the end-users, masquerading as trusted validation methods like Google reCAPTCHA.
Malicious JavaScript Deployments
In addition to the PHP scripts, infected sites often utilize malicious JavaScript to redirect visitors or act as data skimmers, especially during sensitive transactions like online checkouts. The specifics of how these breaches occur are still unclear, but can be traced typically to vulnerabilities in themes or plugins, compromised admin accounts, or poor server configurations.
Common Vulnerabilities Exploited
A recent report from Patchstack disclosed the frequent exploitation of four significant security vulnerabilities in WordPress:
Mitigation Strategies
To safeguard against these risks, WordPress administrators should:
Conclusion
As WordPress remains a primary target for threat actors, recognizing the tactics they employ is key to fortifying web security. By staying informed about vulnerabilities and deploying appropriate defenses, website owners can mitigate the risks of such attacks.
For enhancing your WordPress site’s security, consider our security services.
EN 
BG