Executive Summary
Securonix Threat Research has identified a sophisticated attack chain named TRUST#GRAFT that pivots from a browser-resident JavaScript loader to a persistent WordPress server-side backdoor. The attack does not rely on traditional authentication bypass; instead, it abuses existing, authenticated administrator browser sessions to perform legitimate plugin installation actions. Once the browser executes the malicious script, it fingerprints the environment and checks for /wp-admin/ access. If authorized, it automatically uploads and activates a malicious ZIP payload masquerading as a 'Web Media Optimizer' plugin.
The technical chain involves multi-stage evasion, including fake Cloudflare-style verification overlays and proof-of-work gating to hinder analysis. The secondary PHP payload achieves durable persistence by copying itself into the WordPress 'must-use' plugins directory (mu-plugins), effectively hiding from standard administration interfaces. This enables the attacker to maintain long-term control, inject remote scripts into public-facing pages, and regain administrator access via token-gated backdoors even after the initial session expires.
This campaign highlights the risk of 'grafted' trust, where an administrator's routine web browsing activity while logged into a CMS can compromise the entire underlying web infrastructure. Organizations utilizing WordPress should immediately audit their mu-plugins directories and enforce strict session isolation for administrative tasks.