Three fake plugins from 2024-2025 share one trick: stay silent for logged-in users and load the real payload only for visitors, with timestamp forging, a hidden login URL, and eval-from-a-URL on top.

An unobfuscated 8 KB PHP script finds every wp-config.php on a hosting account, inserts an administrator named Options straight into each database, reports the login to a remote server, and deletes itself.

Website injections that never contain the attacker’s real URL. They read it from a GitHub file or a Binance Smart Chain contract instead.

An obfuscated JavaScript file replaces a WordPress site with a fake “Suspicious IP Address” page that tricks Windows visitors into running a hidden PowerShell command.

A one-line eval(atob()) injection loads a skimmer that injects a fake credit card form into the checkout and streams every form field to the attacker over a WebSocket.