Yangi TRUST#GRAFT Hujumi WordPress Admin Brauzerlarini Zararli Plaginlarni O'rnatishga Aldaydi

TRUST#GRAFT — WordPress autentifikatsiyasini hech qachon buzmaydigan JavaScript-dan WordPress-ga hujum zanjiri.

Buning o'rniga, u allaqachon tizimga kirgan administrator brauzeriga ishonchni ishlatadi va shu sessiyadan foydalanib doimiy PHP orqa eshikni o'rnatadi.

Ko'plab administratorlar wp-admin'da kundalik brauzer bilan bir xil profilda tizimga kirgan holda qoladilar. Bu odat hujumchilarga foydalanish mumkin bo'lgan tayanch nuqtasini beradi.

Parolni taxmin qilish o'rniga, yuklovchi bir xil manbadan (same-origin) cookie-fayllarni va WordPress sahifaga bergan nonce-ni qayta ishlatadi.

Bu yerda ko'p faktorli autentifikatsiya cheklangan himoya beradi, chunki hujum allaqachon autentifikatsiyani tugatgan brauzer orqali harakat qiladi.

Yuklovchi avval haqiqiy sahifani yashiradi. U to'liq ekranli iframe-ni Cloudflare "Bir lahza" ekrani sifatida uslublaydi va clipboard-yozish ruxsatini oladi.

Overlay vaqt sotib olayotganida, skript tashrifchini barmoq izini oladi: avtomatlashtirish belgilari, WebGL render tafsilotlari, canvas xeshlar, vaqt zonasi va til ma'lumotlari.

Keyin u kichik proof-of-work muammosini yechadi va barmoq izi hamda kampaniya parametrlarini kontrollerga yuboradi, dinamik kontent paydo bo'lishidan oldin. Bu filtr operatorlarga oddiy brauzerlarni tahlil vositalaridan ajratishga yordam beradi.

Foydalanuvchi aldov bilan o'zaro aloqada bo'lganda, skript hujumchi taqdim etgan matnni clipboard-ga nusxalashga urinadi — bu ClickFix uslubidagi savdo usuliga mos keladi.

Yuklovchi shuningdek localStorage va sessionStorage-da token, jwt, auth, api, secret, session, bearer yoki csrf nomli kalitlarni qidiradi. U mos qiymatlarni, shuningdek document.cookie-ning 1500 belgigacha qismini hisobot nuqtasiga yuboradi.

HttpOnly cookie-fayllar bu usul bilan o'qib bo'lmaydi, lekin sahifa orqali kirish mumkin bo'lgan har qanday token ochiladi.

Birinchi vektorni tasdiqlash skriptni joylagan sahifani, HTTP referrer-larni, yo'naltirish zanjiri dalillarini, veb-server jurnallarini, DNS va proksi telemetriyani, hamda skript tegi qachon paydo bo'lganini ko'rsatuvchi kontent-boshqaruv yozuvlarini talab qiladi.

TRUST#GRAFT jarayon oqimi (Manba: Securonix).

Securonix Threat Research TRUST#GRAFT-ni tahlil qildi; zanjirni an'anaviy server tomonidagi ekspluatatsiya emas, balki brauzer vositasidagi joylashtirish mexanizmi sifatida tushunish yaxshiroq. Uning hal qiluvchi sharti — autentifikatsiyalangan WordPress administrator brauzeri.

Eng muhim xatti-harakat. Agar tashrifchi autentifikatsiyalangan administrator sessiyasiga ega bo'lsa, skript plagin yuklash sahifasini so'raydi, WordPress nonce-ni ajratib oladi, wm.zip nomli tayyorlangan ZIP-ni yuklab oladi va uni update.php?action=upload-plugin-ga yuboradi.

Iframe minimal "Bir lahza" sahifasini ko'rsatadi va ota-ona hostname-ni ko'rsatishga urinadi, bu tanish tekshirish uslubidagi aldovni hosil qiladi, qolgan mantiq esa fon rejimida ishlaydi.

Keyin u plaginlar sahifasini oladi va faollashtirishni ishga tushiradi. Har bir so'rov administrator vakolati ostida WordPress-ning qonuniy funksiyasidan foydalanadi.

WordPress lab sahifasi ustida ko'rsatilgan soxta tekshirish iframe (Manba: Securonix).

Shuning uchun zanjir mustaqil autentifikatsiya chetlab o'tishni isbotlamaydi. U ishonchli sessiyani va plagin o'rnatish huquqini suiiste'mol qiladi.

Yuklama Web Media Optimizer nomli, 2.1 versiyali PHP plaginidir. Nomiga qaramay, bu orqa eshik.

U wp_head orqali ommaviy sahifalarga masofaviy JavaScript-ni kiritadi, kontroller manbasini olishda TLS tekshiruvini o'chiradi va o'zini plagin ro'yxatlaridan, harakat havolalaridan va yangilanish bildirishnomalaridan yashiradi.

Qattiq kodlangan token ikkita yo'nalishni boshqaradi: biri birinchi administrator hisobi uchun autentifikatsiya cookie-faylini o'rnatadi, ikkinchisi masofaviy skript manbasini almashtiradi.

Web Media Optimizer PHP yuklamasini ko'rsatuvchi tiklangan wm.zip tarkibi (Manba: Securonix).

Doimiylik eng xavotirli element. Faollashtirilganda, plagin o'zini wp-content/mu-plugins/wmedia-recovery.php-ga nusxalaydi.

WordPress must-use plaginlarini avtomatik ravishda yuklaydi va ular standart Plaginlar ekranida ko'rinmaydi. Ko'rinadigan plagin katalogini o'chirish orqa eshikni faol qoldiradi.

Himoyachilar yuklash sahifasiga yetib boradigan, ZIP yuklaydigan va plaginni yaqin ketma-ketlikda faollashtiradigan yagona administrator sessiyasini korrelyatsiya qilishlari kerak.

Kutilmagan yuklashlar yoki faollashtirishlar uchun audit jurnallari tekshirilishi kerak. Plagin kataloglari admin konsoli orqali emas, to'g'ridan-to'g'ri tekshirilishi kerak va wp-content/mu-plugins wmedia-recovery.php uchun tekshirilishi kerak.

Administratorlar kundalik brauzer uchun imtiyozli sessiyalardan foydalanmasliklari va shubhali brauzer buzilishidan keyin qayta autentifikatsiya qilishlari kerak.

Dastlabki yetkazib berish vektori tasdiqlanmagan. Yuklovchi nomzodlari gerlace[.]com, vtevens[.]icu va caapman[.]me-da aniqlangan va /p/wm.zip yo'li bir nechta domenlarda takrorlanadi.

Bu artefaktlar skript qurbonlarga qanday yetib borganini ko'rsatmaydi. Buni tasdiqlash referrer ma'lumotlari, server jurnallari, sahifa manbasi va DNS yoki proksi telemetriyasini talab qiladi. Faqat hosting tafsilotlari atributsiya sifatida qabul qilinmasligi kerak.

WordPress nonce-lari cross-site request forgery-ga qarshi himoya qiladi; ular kirish nazorati mexanizmi emas.

WordPress-ning ishlab chiquvchi hujjatlarida nonce-lar hech qachon autentifikatsiya, avtorizatsiya yoki kirish nazorati uchun ishonilmasligi va currentusercan() sezgir harakatlarni himoya qilishi kerakligi aytilgan. TRUST#GRAFT bu farq nima uchun muhimligini ko'rsatadi.

IOC-lar

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defanged (masalan, [.]) qilingan. Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.

TRUST#GRAFT, a JavaScript-to-WordPress attack chain that never breaks WordPress authentication.

Instead, it borrows the trust placed in an already logged-in administrator’s browser and uses that session to install a persistent PHP backdoor.

Many administrators stay signed in to wp-admin in the same profile they use for everyday browsing. That habit gives attackers a usable foothold.

Rather than guessing passwords, the loader reuses same-origin cookies and a nonce that WordPress issued to the page.

Multifactor authentication offers limited protection here, because the attack acts through a browser that has already completed authentication.

The loader first hides the real page. It inserts a full-screen iframe styled as a Cloudflare “Just a moment” screen, with clipboard-write permission.

While the overlay buys time, the script fingerprints the visitor, collecting automation markers, WebGL renderer details, canvas hashes, timezone, and language data.

It then solves a small proof-of-work challenge and submits the fingerprint and campaign parameters to its controller before any dynamic content appears. This gating can help operators separate ordinary browsers from analysis tools.

When the user interacts with the lure, the script attempts to copy attacker-supplied text to the clipboard, a pattern consistent with ClickFix-style tradecraft.

The loader also searches localStorage and sessionStorage for keys named token, jwt, auth, api, secret, session, bearer, or csrf. It posts matching values, plus up to 1,500 characters of document.cookie, to a reporting endpoint.

HttpOnly cookies are not readable this way, but any token held in page-accessible storage is exposed.

Confirming the first vector requires the page that embedded the script, HTTP referrers, redirect-chain evidence, web server logs, DNS and proxy telemetry, and any content-management records showing when the script tag appeared.

TRUST#GRAFT process flow (Source : Securonix).

Securonix Threat Research analyzed TRUST#GRAFT, the chain is best understood as a browser-mediated deployment mechanism, not a traditional server-side exploit. Its decisive condition is an authenticated WordPress administrator browser.

Most important behavior. If the visitor holds an authenticated administrator session, the script requests the plugin-upload page, extracts the WordPress nonce, downloads a staged ZIP named wm.zip, and posts it to update.php?action=upload-plugin.

The iframe displays a minimal Just a moment page and attempts to show the parent hostname, producing a familiar verification-style lure while the rest of the logic runs in the background.

It then fetches the plugins page and triggers activation. Every request uses legitimate WordPress functionality under the administrator’s authority.

Fake verification iframe displayed over the WordPress lab page (Source : Securonix).

The chain therefore does not prove a standalone authentication bypass. It abuses a trusted session and the right to install plugins.

The payload is a PHP plugin named Web Media Optimizer, version 2.1. Despite its name, it is a backdoor.

It injects remote JavaScript into public pages through wp_head, turns off TLS verification when fetching its controller source, and hides itself from plugin lists, action links, and update notices.

A hardcoded token gates two routes: one sets an authentication cookie for the first administrator account, and the other replaces the remote script source.

Recovered wm.zip contents showing the Web Media Optimizer PHP payload (Source : Securonix).

Persistence is the most concerning element. On activation, the plugin copies itself to wp-content/mu-plugins/wmedia-recovery.php.

WordPress automatically loads must-use plugins, and they do not appear on the standard Plugins screen. Deleting the visible plugin directory alone leaves the backdoor active.

Defenders should correlate a single administrator session that reaches the upload page, uploads a ZIP, and activates a plugin in close succession.

Audit logs should be checked for unexpected uploads or activations. Plugin directories should be inspected directly rather than through the admin console, and wp-content/mu-plugins should be checked for wmedia-recovery.php.

Administrators should avoid using privileged sessions for routine browsing and should reauthenticate after suspected browser compromise.

The initial delivery vector remains unconfirmed. Loader candidates were identified on gerlace[.]com, vtevens[.]icu, and caapman[.]me, and the /p/wm.zip path recurs across several domains.

These artifacts do not show how the script reached victims. Confirming that requires referrer data, server logs, page source, and DNS or proxy telemetry. Hosting details alone should not be treated as attribution.

WordPress nonces protect against cross-site request forgery; they are not an access control mechanism.

WordPress’s developer documentation states that nonces should never be relied on for authentication, authorization, or access control, and that currentusercan() should guard sensitive actions. TRUST#GRAFT shows why that distinction matters.

IOCs

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.