In a stunning development that absolutely no one maintaining a WordPress site saw coming, hackers have once again discovered that the world’s most popular content management system — which powers a staggering 43% of all websites and 118% of every malware incident — might have a few vulnerabilities.
According to a report from Google Threat Intelligence Group (GTIG), a mysterious cyber villain known as UNC5142 has been targeting WordPress sites using a brand new technique. Analysts have confirmed that the group is not just “some guy in a basement,” but actually “several guys in several basements, connected via a Discord server.”
WordPress Users: “Is It Fixed If I Just Hit Update?”
UNC5142 reportedly infiltrates sites using outdated themes, abandoned plugins, and databases running on servers last patched during the Obama administration. Once inside, they deploy a multi-stage JavaScript downloader called CLEARSHORT, which is believed to be named after the average length of a typical WordPress developer’s attention span when reading documentation.
This malware is then used to enable a revolutionary new cybercrime method called EtherHiding, which sounds like a rejected Marvel supervillain but is actually a technique for hiding malicious code on public blockchains. Experts say this makes the malware “harder to remove, harder to track, and significantly more exciting for cryptocurrency investors who don’t read beyond the headline.”
Blockchain: Solving Problems It Did Not Create
EtherHiding stores malicious code on the BNB Smart Chain, because, according to the hackers, “Bitcoin is boring now, and Ethereum gas fees are rude.”
Cybersecurity analysts expressed shock that blockchain — a technology originally invented to inflate cartoon dog coins — has now evolved into a sophisticated delivery mechanism for global malware operations.
“Honestly, it’s impressive,” said one expert. “I still can’t get MetaMask to connect to OpenSea, but these guys are deploying weaponized smart contracts from a Raspberry Pi.”
Cloudflare Used For Good, Evil, and Developer Procrastination
Once the malware is ready, it spins up a landing page on a Cloudflare dev domain, which security experts note is roughly the same as hosting it on the front door of a police station with a sign that says “NOT CRIME.”
The landing page then activates a ClickFix social engineering tactic, tricking visitors into running malicious commands through Windows Run or Mac’s Terminal — something no normal human has done voluntarily since they accidentally followed a StackOverflow tutorial in 2017.
Early victims reportedly agreed to run the commands because “the page said it would fix the website being slow,” something every WordPress user has been emotionally vulnerable to since 2003.
WordPress Responds By Releasing Another Major Update That Breaks Everything
In response to the attack, WordPress core developers have assured the public they are “very concerned” and will “absolutely look into this right after we finish shipping Gutenberg Phase 11: Block-Based Air Fryer Recipes.”
Meanwhile, cybersecurity experts offered actionable advice to site owners:
- Stop installing plugins last updated during the Bush administration.
- Do not trust code stored on a blockchain, regardless of how cool the marketing website looks.
- If a webpage asks you to open Terminal and paste in a command, maybe don’t.
Experts estimate the malware could affect thousands of websites, millions of users, and at least one guy on Fiverr charging $15 to “fix your site tonight.”
However, one major question remains unanswered:
“Will this reduce the number of people using WordPress?”
Industry analysts firmly agree: absolutely not.
After all, WordPress may be vulnerable, complicated, and constantly on fire —
but it’s free, and developers remember what happened the last time they tried Joomla.