Threat Actors Hide Malware in WordPress Sites to Execute Remote Code

**Executive Summary:** Security researchers uncovered a WordPress-targeted malware campaign that abuses the mu-plugins directory to persistently load three payloads — a fake-update redirector (wp-content/mu-plugins/redirect.php), a remote code execution webshell (wp-content/mu-plugins/index.php), and a spam injector (wp-content/mu-plugins/custom-js-loader.php) — resulting in visitor redirection to malicious sites, full site compromise, and reputational damage; recommended defenses include regular file scans, timely updates, 2FA for admins, and file integrity monitoring.