WordPress malware campaign hides payloads in Steam profiles
Nearly 2,000 WordPress sites were infected by malware that hides C2 data in Steam profile comments using invisible Unicode characters.
Intelligence analysis by GPT-5.4 Mini
GoDaddy says a long-running WordPress malware campaign uses Steam Community profile comments as a covert staging area. Hidden Unicode characters reconstruct a payload that pulls JavaScript from hello-mywordl[.]info and drops a backdoor.
A group of bad actors hid secret messages inside normal-looking Steam comments. The messages were written with tiny invisible marks, like writing a note in invisible ink inside a page of a storybook.
A WordPress site would read those hidden marks, turn them into a web address, and fetch bad code from there. That code could sneak onto the site and act like a secret door.
The danger is that the bad code tries hard to look normal. It uses common names and regular website tools, so defenders have to look for odd clues instead of obvious signs.
Analysis
What happened
GoDaddy security engineers found malware on about 1,980 WordPress sites tied to a campaign first uncovered in July 2025. The attacker appears to use Steam Community profile comments as a covert place to store command-and-control data, instead of running a separate server for that purpose.
How the hiding works
The malware loads specific Steam profiles during a WordPress page visit and pulls text from comments that look harmless. In reality, the comments contain invisible Unicode characters that encode a payload. GoDaddy says the malware uses six characters for this trick, then maps them into binary and rebuilds bytes from the hidden stream.
That decoded payload is used to assemble a URL for hello-mywordl[.]info, which serves JavaScript that gets injected into WordPress frontend pages. The fetched file is disguised with names that look like normal libraries, such as asahi-jquery-min-bundle and lodash.core.min.js.
What the malware does next
The final stage installs a backdoor that listens for specially crafted POST requests. If a specific authentication cookie is present, the backdoor can accept base64-encoded PHP code through a POST parameter. GoDaddy also says the malware uses octal and hex escapes, randomized function names, fake disabled logging, and standard WordPress APIs to blend in.
What defenders should look for
The report recommends checking for Steam Community references, suspicious external JavaScript injections, outbound connections from WordPress servers to Steam, invisible Unicode characters, _transient_caption_ cache entries, disabled SSL verification in cURL requests, and POST requests containing the malware cookie or new_code parameter. GoDaddy also advises restoring from a known-good backup before the infection date when possible, because leftover components can let attackers reinstall removed code through the backdoor.
Key points
- GoDaddy says nearly 2,000 WordPress sites were affected by the campaign.
- The malware hides command-and-control data in Steam profile comments using invisible Unicode characters.
- Decoded data builds a URL that serves injected JavaScript from hello-mywordl[.]info.
- The final stage installs a backdoor that can accept base64-encoded PHP through a special POST flow.
- Defenders are told to look for Steam references, strange outbound traffic, and hidden Unicode in site data.
The report gives site owners specific places to look, including Steam references, outbound connections, hidden Unicode characters, and suspicious JavaScript loads. If teams catch those signs early and restore from a known-good backup, they may remove the infection before the backdoor is used again.
The campaign shows how attackers can hide control data in a third-party platform and keep infrastructure light. If any part of the infection remains active, GoDaddy warns the backdoor can be used to reinstall removed code, making cleanup harder.
