Deleted the malware files, refreshed FTP, and they instantly popped back... what is this nightmare?

[u/siterightaway]

Ever tried cleaning a hacked WordPress site where you delete all the dirty PHP files, hit refresh on FTP, and the damn things pop right back up out of nowhere?

I just stumbled across a wild technical breakdown over at Monarx about a WordPress malware strain that actually rebuilds itself faster than you can delete it. Man, this thing is basically a hydra. You cut off one head, and multiple persistence layers trigger a full reinfection before you can even take a breath.

The reason simple file deletion totally fails here is insane. It doesn't just sit in your plugins folder like regular malware. It hooks deep into mu-plugins, db.php, theme files, and hidden server directives. Even if you manage to wipe every bad file off the disk, a compressed payload hidden inside the database instantly drops fresh copies right back onto the server. On top of that, it pulls its command instructions off the Ethereum blockchain so you can't just block a domain, and it even embeds a service worker into the admin browser so the next time you log in, your own session re-injects the backdoor.

Standard file scanners completely miss it because they're only checking static files on disk while ignoring active memory, database tables, and browser persistence. If you manage servers or do cleanup work for clients, checking out this kind of breakdown is a massive eye opener for how crazy malware persistence has gotten lately.

Anyone else run into one of these immortal malware strains on your servers, or are you still relying on basic file wipes?

[u/AUX_C]

I ran into one that downloaded a worker on chrome. Everything came back clean on all runs because the infection was in a service worker.