Securonix Threat Research has examined TRUST#GRAFT, an attack chain that leverages fake Cloudflare verification pages to convert authenticated WordPress administrator browsers into a persistent PHP backdoor delivery system. The attack's success hinges on malicious JavaScript running within the same WordPress site's browser context while an administrator with plugin installation privileges is logged in. The recovered components indicate a coordinated browser-to-server attack, but researchers have not confirmed the initial method by which the malicious JavaScript reached the affected pages.
Cloudflare's Fake Loader Deceives Admins A JavaScript loader covers the page with a full-screen iframe that mimics Cloudflare's "Just a moment" verification screen. If a valid session is present, the script fetches the plugin-upload page, retrieves a WordPress nonce, downloads wm.zip, and submits it via update.php?action=upload-plugin. Additionally, the plugin offers token-gated functions that can alter the remote source or create an authentication cookie for the first administrator account, allowing passwordless access.
Researchers discovered infrastructure linked to caapman[. ]me, vtevens[. ]icu, gerlace[.
]com, nutmann[. ]club, okuneva[. ]sbs, and vilialobos[.]lol. Securonix advises separating WordPress administration from routine browsing, restricting plugin installation permissions, and monitoring uploads, activations, and newly used PHP files.
Respondents should preserve browser and server evidence, remove both plugin copies, scrutinize suspicious settings and injected scripts, alter administrator credentials, and invalidate active sessions. Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
