WordPress and the danger of nulled plugins and themes
Giuliano Cardoso · · 2 min read
Nobody told me about it, I saw it myself: a WordPress installation infested by an APT (https://www.kaspersky.com/resource-center/definitions/advanced-persistent-threats) that lives up to its name. Even after deleting the files with the malicious code, they came back within seconds.
This is a very sophisticated threat that uses several techniques to stay in the installation even after an antivirus scan and a manual cleanup, because it has several safeguards and triggers to come back.
On top of that, the malicious code snippets are obfuscated, which makes them impossible to understand.
So far, I believe the only solution is to abandon this instance and install everything from scratch. The catch is that it is an online store, with a lot of very important data and customizations that take a lot of work to bring over to the new installation.
And where did this problem come from? From using nulled plugins.
These plugins, which can be bought for very low prices on dubious websites or found on forums, often contain malicious code and are real Trojan horses that you will be bringing into your WordPress instance.
That is why I recommend everyone avoid falling for the scam: following the maxim that nothing is free on the internet, and if you don't pay for something, you are the product, here you will be the victim and have your infrastructure hijacked by third parties.