Nearly 2,000 WordPress websites have been infected with malware that uses Steam Community profile comments to hide command-and-control data, according to GoDaddy security researchers.
The campaign uses invisible Unicode characters inside normal-looking Steam comments to hide a payload that builds a URL for a malicious script. By abusing Valve’s Steam platform, the attacker avoids running a separate command-and-control server and makes the activity harder for traditional security tools to detect.
GoDaddy says the campaign was first discovered in July 2025, and its security engineers have since found the malware on around 1,980 WordPress websites. It is still unclear exactly how the attackers are breaking into the sites. Researchers believe the possible entry points include stolen WordPress admin logins, compromised FTP or SFTP credentials, vulnerable themes or plugins, or even a supply-chain compromise.
Once the first-stage malware is planted on a WordPress site, it uses page loads to contact specific Steam profiles and pull text from harmless-looking comments. However, those comments contain hidden Unicode characters that secretly carry the malicious payload. In some cases, the comments are disguised as ASCII art to make them appear even less suspicious.
GoDaddy researchers said the attacker uses six invisible Unicode characters to encode the payload, including zero-width non-joiner, zero-width joiner, function application, invisible times, invisible separator, and invisible plus. The decoder ignores visible characters and maps the invisible ones to numbers, then converts them into binary data and rebuilds the hidden payload.
According to GoDaddy, this method allows binary data to be hidden inside ordinary text. The visible characters act as camouflage, while the invisible ones carry the actual malicious instructions.
The decoded payload is then used to create a URL connected to hello-mywordl[.]info, which serves JavaScript code that gets injected into every frontend WordPress page. The malware is disguised as a legitimate JavaScript library using file names such as asahi-jquery-min-bundle and lodash.core.min.js.
The final stage of the attack installs a backdoor that responds to specially crafted POST requests containing a specific authentication cookie. If the required tEcaKKXEsb cookie is present, the backdoor accepts base64-encoded PHP code through a POST parameter, allowing attackers to run malicious code on the infected site.
GoDaddy also found several evasion techniques in the malware, including obfuscated strings using octal and hex escapes, randomized function names, fake disabled logging code, and the use of normal WordPress APIs to blend in with regular website activity.
Website owners are advised to check for references to Steam Community URLs, suspicious external JavaScript injections, outbound connections from WordPress servers to Steam, and unexpected scripts loading from domains such as hello-mywordl[.]info. Other warning signs include invisible Unicode characters, suspicious transient_caption cache entries, disabled SSL verification in cURL requests, and POST requests containing the malware’s authentication cookies or the new_code parameter.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
GoDaddy recommends restoring affected websites from a clean backup created before the infection date. If that is not possible, site owners should perform a full manual cleanup, because attackers may be able to reinstall removed malware if even one backdoor component remains active.
