Crypto-Powered WordPress Malware Refuses to Die

WordPress Malware Uses Ethereum Gateways to Restore Hidden Components

The SC malware appeared in at least eight locations on one compromised site and can query a smart contract through roughly 20 public gateways.

Crypto-Powered WordPress Malware Refuses to Die

A highly persistent WordPress malware strain is using Ethereum infrastructure to stay alive, with redundant copies scattered across compromised sites allowing it to rebuild itself even after attempted cleanup.

WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

Ravie LakshmananOct 01, 2026Vulnerability / Web Security Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the "SC_" markers present in the injected content. Sucuri

WordPress SC Malware: 8 Persistence Methods, Blockchain C2

Security researchers have uncovered a WordPress malware codenamed SC that uses the Ethereum blockchain for command-and-control communication, making removal extremely […]

WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor

A WordPress backdoor is bringing deleted malware back within seconds, turning routine cleanup into a cycle of reinfection. Called SC, the infection spreads its working parts across website files, the database, and server memory, allowing surviving components to restore those removed. The investigation does not establish the original entry point or the number of affected […]