Hackers abuse WordPress MU-Plugins to hide malicious code

Sucuri researchers report that threat actors are increasingly abusing WordPress mu-plugins (wp-content/mu-plugins/) as a persistent, stealthy foothold to deploy three malicious payload types: a redirector that sends visitors to a fake browser-update page (drive-by malware distribution), a GitHub-backed webshell (index.php / 403WebShell) enabling remote code execution and data theft, and a JavaScript loader that replaces site images with explicit content and hijacks outbound links; site owners are advised to patch plugins/themes, minimize installed components, and protect admin accounts with strong credentials and MFA.