WORDPRESS MALWARE HIDES IN STEAM PROFILES

The campaign exploits Steam's social features as an unconventional infrastructure layer for malicious operations. Attackers hide C2 data in comments on compromised or attacker-controlled Steam profiles, allowing infected WordPress installations to retrieve commands while evading detection. This method bypasses traditional network monitoring since traffic to Steam appears legitimate. The malware likely gains initial access through vulnerable plugins or weak credentials on WordPress sites. Security researchers identified the infection pattern across a distributed set of WordPress installations. The use of Steam profiles demonstrates how attackers adapt to exploit trusted platforms for command distribution. WordPress site administrators should immediately audit active plugins, update to the latest versions, and enforce strong credentials. Security teams should monitor for unusual outbound connections to Steam Community domains from web servers.