Ghost Folders: “Directory Shadowing” Hack Hijacks WordPress SEO

A Sucuri analysis details a stealthy WordPress malware campaign called "directory shadowing" in which attackers create physical directories matching site permalinks (e.g., /about-us/) so the webserver serves attacker-controlled content instead of the legitimate WordPress page; the attack uses files named index.php, indexx.php (clean copy), and readme.txt (spam), performs User-Agent checks to cloak content to search engine crawlers, and requires removing the malicious directories and requesting re-indexing to remediate.