WordPress malware campaign hides payloads in Steam profiles

Nearly 2,000 WordPress sites were infected by a campaign that hides C2 data in Steam Community comments using invisible Unicode characters; the compromised sites fetch obfuscated JavaScript from hello-mywordl.info masquerading as legitimate libraries and deploy a PHP backdoor that accepts base64-encoded payloads when a specific authentication cookie is present.