Variants of popular PHP web shells have been popping up and analysis reveals that they contain a hidden backdoor used to steal the unauthorized access.

A new PHP web shell by ALFA TEaM that has some interesting new features like the ability to create a cPanel phishing page that blocks the victim from a part of their website until they interact with the phishing page.

How do hackers use a PHP backdoor that is injected into a single line of code in a website’s file? Why is it better at evading malware scanners than other PHP backdoors?