ShapedPlugin - Suspicious Parent Process for WooCommerce Backdoors

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Flags any non-web process (e.g., cmd, powershell) that drops the specific install-persistent.php file, indicating post-exploitation script activity related to the ShapedPlugin supply chain compromise.