ShapedPlugin - Web Server Dropping Multiple Backdoors in Window

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•6

Detects a web server process creating at least two different backdoored WooCommerce files within a 5-minute window. This behavior is indicative of a supply chain compromise targeting ShapedPlugin, where malicious plugins distribute backdoored files.