WordPress Malware C2 Communication via Steam Community Profiles

Ankit Mehta@Secvyn

•updated Jun 12, 2026•6•0•3

Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.