WordPress Malware Comes Back After Removal Using a Self-Healing Backdoor

Sucuri analysts documented a resilient WordPress backdoor called “SC” that disperses its payload across plugin/theme files, the database, scheduled tasks, and server memory to automatically restore removed components; it hides admin accounts, collects admin session tokens, disables security plugins, and uses multiple public Ethereum RPC gateways as a blockchain-based command channel. The report provides cleanup guidance (disable loaders, remove database payloads, clear shared memory and scheduled tasks, rotate credentials) and a detailed IoC table listing files, configuration directives, database artifacts, recovery archives, and other persistence markers.