A new malware campaign has infected nearly 2,000 WordPress websites by hiding command-and-control data inside Steam Community profile comments. According to BleepingComputer, the malware abuses invisible Unicode characters in Steam profile comments to conceal encoded data, which compromised WordPress sites later decode and use to fetch malicious JavaScript. Because naturally, even gaming profiles are now being used as malware storage lockers. 

Why This Technique Is Dangerous 

The campaign is concerning because attackers are not simply placing malicious scripts on suspicious domains. Instead, they are using a legitimate and widely trusted platform, Steam, as part of their attack infrastructure. This helps the traffic blend in better and makes simple blocklisting harder, because blocking an entire legitimate platform can affect normal users and services. GoDaddy Security, which analyzed the campaign, also reported that the malware uses Steam Community profile comments to hide encoded command-and-control data behind Valve’s trusted platform. 

The technique also shows how attackers are becoming more creative in hiding malicious infrastructure. Instead of keeping all payloads on clearly malicious servers, they can store instructions or encoded data in places that look harmless to basic checks. The compromised WordPress site then decodes the hidden characters, builds URLs, and loads malicious JavaScript that can support backdoor access and further compromise.

What Website Owners Should Learn 

For WordPress website owners, this incident is another reminder that website security is not only about protecting content. A compromised website can become part of a malware distribution chain, even if the business itself is not the final target.

Website owners should keep WordPress core, plugins, and themes updated, remove unused plugins, avoid nulled or pirated themes, enforce strong admin passwords, enable multi-factor authentication for admin users, and regularly scan files for unauthorized changes. They should also monitor for unknown JavaScript, strange external domains, hidden admin users, modified theme files, suspicious POST requests, and unexpected redirects.

The boring maintenance work matters. Patch management, backups, least-privilege access, and file integrity monitoring may not sound glamorous, but neither does explaining to customers that your website was quietly helping criminals distribute malware.

What Organizations Should Do 

Organizations should not rely only on reputation-based filtering. This campaign shows that malicious activity can be staged through legitimate platforms and compromised websites. Security teams should monitor DNS and web traffic for unusual script-loading behavior, suspicious external JavaScript, browser redirects, and communication patterns that do not match normal website activity.

Endpoint protection, DNS filtering, web filtering, and behavioral monitoring should work together. A domain may look legitimate, but the behavior around it may still be malicious. That is where layered security becomes important, because attackers are clearly not limiting themselves to one neat little box for our convenience.

Final Comment 

This WordPress malware campaign shows how attackers are abusing trusted platforms and compromised websites to hide malicious activity in plain sight. By storing encoded command-and-control data inside Steam profile comments, the attackers made detection harder and used a legitimate platform as cover.

The key lesson is simple: trust cannot be based only on domain reputation. Website owners must secure their WordPress environments, and organizations must monitor behavior, not just URLs. Attackers are no longer just hiding in dark corners of the internet. They are hiding inside normal platforms, normal websites, and normal-looking traffic. That is exactly why modern security needs visibility, context, and continuous monitoring, not just a checklist that was last updated when Flash Player was still ruining everyone’s day.


Nearly 2,000 WordPress websites were infected with malware that relies on Steam Community profile comments to hide command-and-control (C2) data. [...]

Source: WordPress malware campaign hides payloads in Steam profiles via Bleeping Computer — published 01 Jun 2026.