Four Perl scripts wrapped in a base64 eval: an IRC bot that takes orders from a single nick, and a two-part WordPress brute-forcer that reports cracked logins to a third-party URL.

A PHP file shows a fake “Login Form”, messages a Discord channel about every attempt, and after login downloads its real shell from a remote .jpg and runs it with eval.

A 2022 WordPress script injection and its 2023 successor, decoded stage by stage: new marker, a self-deleting element, a redirector that spares WordPress admins, and domains that now belong to someone else.

Three PHP backdoors use random /* */ comments and segmented function names to hide code execution and a remote redirect payload.

A 4 KB script wrapped in three layers of obfuscation does one thing: when a first-time visitor arrives from another site, it fetches code from scriptobject.com and runs it.