Malware Root Cause Analysis. topreptraining.com

One-sentence root cause

The attacker gained access via a plugin CVE or credential stuffing in early June, installed a six-layer self-healing persistence stack including a ManageWP Worker backdoor connected to their dashboard, and Mindbees cleaned the visible script tag each round while leaving all delivery infrastructure intact.

Confirmed threat identity

Research sourced from Trend Micro, Sekoia, Rapid7, LevelBlue/SpiderLabs, and GoDaddy threat intelligence.

How the site was used against visitors

1. Injected script loads from the payload domain on every page visit
2. Overlay displays a fake "Verify you are human" CAPTCHA (visually mimics Cloudflare Turnstile)
3. navigator.clipboard.writeText() silently poisons the visitor's clipboard with a base64-encoded PowerShell command
4. Visitor is told: "Press Win+R, then Ctrl+V, then Enter"
5. Visitor executes the command; a stealer downloader runs
6. Documented payloads: Vidar Stealer, SectopRAT, Lumma Stealer. The site's visitors are the final victims, not the site itself.

The six-layer persistence stack

All six layers were almost certainly present. Mindbees removed the surface injection each round but did not touch any of these.

Attack and persistence flow

How the attacker got in and why cleanup kept failing. Scroll to zoom, drag to pan, or present full screen.

flowchart TD
  ENTRY["Initial access ~Jun 10 2026\nPlugin CVE or credential stuffing"]
  ENTRY --> ADMIN["WP admin access gained\n(webmaster or noahw account)"]
  ADMIN --> P1["mu-plugins PHP backdoor\nInvisible to admin panel"]
  ADMIN --> P2["wp_options DB payload\nRe-injects on every page load"]
  ADMIN --> P3["Phantom admin account\nHidden from Users screen"]
  ADMIN --> P4["ManageWP Worker plugin\nAttacker remote dashboard access"]
  ADMIN --> P5["Blockchain C2\nEtherHiding auto domain rotation"]
  P1 & P2 & P3 & P4 & P5 --> INJECT["Script injected into head of every page\nFetches payload domain from Polygon smart contract"]
  INJECT --> BC["Blockchain returns active domain\ntreviro.icu then henriqueq.xyz"]
  BC --> CLICKFIX["ClickFix fake CAPTCHA served to visitors\nClipboard poisoned with PowerShell"]
  CLICKFIX --> VICTIM["Visitor executes Win+R\nStealer malware installed on visitor PC"]
  CLEANUP["Mindbees cleanup rounds\nJun 16 · Jun 23 · Jun 30 · Jul 31"]
  CLEANUP -.->|Removes visible script tag only\nAll 6 persistence layers survive| P1
  P4 -.->|Attacker re-injects\nvia ManageWP dashboard| INJECT

  classDef persist fill:#fef2f2,stroke:#dc2626,color:#7f1d1d;
  classDef inject fill:#fef3c7,stroke:#b45309,color:#78350f;
  classDef victim fill:#fef2f2,stroke:#dc2626,color:#7f1d1d;
  classDef clean fill:#e0f2fe,stroke:#0ea5e9,color:#0c4a6e;
  class P1,P2,P3,P4,P5 persist;
  class INJECT,BC,CLICKFIX inject;
  class VICTIM victim;
  class CLEANUP clean;
  

Most likely initial entry point

Current attack surface (verified 2026-08-11)

Active plugin CVEs on the site

What Mindbees missed every round

Remediation plan. In exact order.

Each step is a prerequisite for the one after it. A later step completed without an earlier one will result in another reinfection.

DELETE FROM wp_options WHERE option_name LIKE 'worker%';

add_filter('rest_endpoints', function($endpoints) {
  if (!is_user_logged_in()) {
    unset($endpoints['/wp/v2/users']);
    unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
  }
  return $endpoints;
});

-- Find hidden admin accounts (bypasses the UI hiding hook)
SELECT ID, user_login, user_email, user_registered FROM wp_users
WHERE user_registered > '2026-06-01';

-- Find stored script payloads in wp_options
SELECT option_name, LEFT(option_value, 200) FROM wp_options
WHERE option_value LIKE '%script%' AND option_value LIKE '%src=%'
   OR option_value LIKE '%treviro%' OR option_value LIKE '%henriqueq%'
   OR option_value LIKE '%base64_decode%' OR option_value LIKE '%eval(%';

-- Check for rogue cron jobs
SELECT option_value FROM wp_options WHERE option_name = 'cron';

Research sources

• Trend Micro: KongTuke ClickFix Abuse of Compromised WordPress Sites
• Sekoia: Unveiling ErrTraffic — ClickFix Malware Distribution Framework
• LevelBlue/SpiderLabs: ErrTraffic v3 Leverages EtherHiding in ClickFix Campaign
• Rapid7: WordPress Compromises Advance Global Stealer Operation
• GoDaddy: Threat Actors Push ClickFix via Stolen Credentials
• Darktrace: ClearFake from Fake CAPTCHAs to Blockchain-Driven Payload Retrieval
• HSEO WordPress Malware: Fake CAPTCHA Popups Re-Adds Itself
• Wordfence: ManageWP Worker Authentication Bypass
• Phantom Admin: WordPress Backdoor Hides Users and Rebuilds from Database

Investigation for ClickUp 86e1wz7h1 (Resolve Website Malware Compromise). Conducted 2026-08-11 via parallel web research agents across attack surface, malware family, plugin CVEs, and ManageWP analysis. The site was clean at time of investigation; the above is an analysis of the reinfection root cause, not an active incident report.