The original text is in EN, taken from the source site. Source ↗

TRUST#GRAFT, a JavaScript-to-WordPress attack chain that never breaks WordPress authentication.

Instead, it borrows the trust placed in an already logged-in administrator’s browser and uses that session to install a persistent PHP backdoor.

Many administrators stay signed in to wp-admin in the same profile they use for everyday browsing. That habit gives attackers a usable foothold.

Rather than guessing passwords, the loader reuses same-origin cookies and a nonce that WordPress issued to the page.

Multifactor authentication offers limited protection here, because the attack acts through a browser that has already completed authentication.

The loader first hides the real page. It inserts a full-screen iframe styled as a Cloudflare “Just a moment” screen, with clipboard-write permission.

While the overlay buys time, the script fingerprints the visitor, collecting automation markers, WebGL renderer details, canvas hashes, timezone, and language data.

It then solves a small proof-of-work challenge and submits the fingerprint and campaign parameters to its controller before any dynamic content appears. This gating can help operators separate ordinary browsers from analysis tools.

When the user interacts with the lure, the script attempts to copy attacker-supplied text to the clipboard, a pattern consistent with ClickFix-style tradecraft.

The loader also searches localStorage and sessionStorage for keys named token, jwt, auth, api, secret, session, bearer, or csrf. It posts matching values, plus up to 1,500 characters of document.cookie, to a reporting endpoint.

HttpOnly cookies are not readable this way, but any token held in page-accessible storage is exposed.

Confirming the first vector requires the page that embedded the script, HTTP referrers, redirect-chain evidence, web server logs, DNS and proxy telemetry, and any content-management records showing when the script tag appeared.

TRUST#GRAFT process flow (Source : Securonix).

Securonix Threat Research analyzed TRUST#GRAFT, the chain is best understood as a browser-mediated deployment mechanism, not a traditional server-side exploit. Its decisive condition is an authenticated WordPress administrator browser.

Most important behavior. If the visitor holds an authenticated administrator session, the script requests the plugin-upload page, extracts the WordPress nonce, downloads a staged ZIP named wm.zip, and posts it to update.php?action=upload-plugin.

The iframe displays a minimal Just a moment page and attempts to show the parent hostname, producing a familiar verification-style lure while the rest of the logic runs in the background.

It then fetches the plugins page and triggers activation. Every request uses legitimate WordPress functionality under the administrator’s authority.

Fake verification iframe displayed over the WordPress lab page (Source : Securonix).

The chain therefore does not prove a standalone authentication bypass. It abuses a trusted session and the right to install plugins.

The payload is a PHP plugin named Web Media Optimizer, version 2.1. Despite its name, it is a backdoor.

It injects remote JavaScript into public pages through wp_head, turns off TLS verification when fetching its controller source, and hides itself from plugin lists, action links, and update notices.

A hardcoded token gates two routes: one sets an authentication cookie for the first administrator account, and the other replaces the remote script source.

Recovered wm.zip contents showing the Web Media Optimizer PHP payload (Source : Securonix).

Persistence is the most concerning element. On activation, the plugin copies itself to wp-content/mu-plugins/wmedia-recovery.php.

WordPress automatically loads must-use plugins, and they do not appear on the standard Plugins screen. Deleting the visible plugin directory alone leaves the backdoor active.

Defenders should correlate a single administrator session that reaches the upload page, uploads a ZIP, and activates a plugin in close succession.

Audit logs should be checked for unexpected uploads or activations. Plugin directories should be inspected directly rather than through the admin console, and wp-content/mu-plugins should be checked for wmedia-recovery.php.

Administrators should avoid using privileged sessions for routine browsing and should reauthenticate after suspected browser compromise.

The initial delivery vector remains unconfirmed. Loader candidates were identified on gerlace[.]com, vtevens[.]icu, and caapman[.]me, and the /p/wm.zip path recurs across several domains.

These artifacts do not show how the script reached victims. Confirming that requires referrer data, server logs, page source, and DNS or proxy telemetry. Hosting details alone should not be treated as attribution.

WordPress nonces protect against cross-site request forgery; they are not an access control mechanism.

WordPress’s developer documentation states that nonces should never be relied on for authentication, authorization, or access control, and that currentusercan() should guard sensitive actions. TRUST#GRAFT shows why that distinction matters.

IOCs

File NamesRelevant SHA256
wmedia-recovery.php86d775c2d5cb459541cd2b0b967fac65ce20c60e483c71c9f7e108d5ad0bd564
ads.php2dfa9e708fdb92e5d36080065f978e33a692c0fe813a75be9c7cdff03be51b6e
wm.zip9215d17e5138cee498bb529e69b1cc7267305136535025e9b49fe173cf648720

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.