Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers

Unknown actors hijacked Nextend’s update infrastructure to push a trojanized Smart Slider 3 Pro update (v3.5.1.35) that installed a multi-layered backdoor capable of pre-authenticated remote code execution via custom HTTP headers, creating hidden admin accounts, persisting in multiple locations, and exfiltrating site and credential data to wpjs1.com; the malicious build was available for approximately six hours and potentially affected sites that updated during that window.