According to U.Today, a highly persistent WordPress malware strain is using Ethereum infrastructure to remain active on compromised websites. The malware maintains its presence through redundant copies placed across multiple affected sites, enabling it to reconstruct itself after cleanup efforts.
Following attempts to remove the malware from individual sites, investigators observed that remnants or new instances reappeared due to the distributed copy strategy. The use of Ethereum infrastructure—specifically network components tied to blockchain operations—supports the malware’s ability to sustain operation without centralized control points that could be easily targeted.
Because copies are spread across several compromised WordPress installations, cleaning one site does not eliminate all instances. This redundancy allows the strain to reinitialize or reactivate under conditions that would otherwise lead to permanent removal. No details were provided regarding detection frequency, site count, remediation timeline, or developer response.
