WordPress malware hijacks Steam comments to hide C2 payloads
Researchers at GoDaddy uncovered a campaign that infected about 2,000 WordPress sites, using hidden Unicode characters in Steam Community profile comments to embed command‑and‑control data. The encoded payload fetches malicious JavaScript from a stealthy domain and opens a backdoor that executes PHP code via specially crafted POST requests.