Modern cyber threats are increasingly shifting away from obvious malicious hosting environments to exploit highly trusted, legitimate web applications. In a sophisticated campaign uncovered by cybersecurity researchers, threat actors have begun leveraging Valve’s Steam Community platform to coordinate and maintain their command and control (C2) infrastructure—the centralized technical system attackers use to maintain communications with compromised applications. By treating public gaming profile comment sections as storage vectors for malicious configurations, attackers can completely hide their traffic inside legitimate HTTPS requests directed at a platform with an indisputable global reputation. This technique circumvents conventional signature-based defense systems and domain reputation blacklists, turning benign web assets into blind spots for security operations centers.
Key Findings and Discovery Context
The campaign, first identified by GoDaddy Security researchers in July 2025, has quietly targeted the broader web ecosystem, infecting approximately 1,980 WordPress sites. Rather than running a monolithic server environment, the malware acts dynamically through a split execution engine divided into a client-side JavaScript injection sequence and a persistent server-side backdoor. The ingenuity of the threat architecture lies in how it stores data. Instead of hardcoding a target malicious domain directly into the PHP source code where an automated scanner could flag it, the malware requests a public Steam profile, parses the comments section, and extracts invisible data hidden within text characters.
Deep Technical Breakdown: The Client-Side Attack Chain
The client-side execution path relies entirely on abusing WordPress page initialization routines to dynamically fetch and run malicious code on unsuspecting visitors’ browsers. When a user requests a page from an infected site, a hidden cURL request is generated behind the scenes by the web server to query specific Steam Community profiles. Some of the specific profiles identified in this active campaign include:
https://steamcommunity[.]com/profiles/76561199096946028/https://steamcommunity[.]com/id/ravypadlihahttps://steamcommunity[.]com/id/enomisvool123/https://steamcommunity[.]com/id/eremohin342
The server fetches the raw HTML layout of these profile pages, setting a custom user-agent string that mimics a traditional Windows 10 desktop environment to prevent any automated structural blocks from Valve. It isolates the HTML container defined by the CSS class commentthread_comment_text. Once the text is successfully extracted, the malware leverages a performance optimization tactic: it saves the content locally within the database using WordPress transients—a native caching mechanism—configured with a strict 300-second (5-minute) expiration countdown. This structural optimization ensures the server does not spam Valve’s API on every single hit, preventing rate-limiting blocks and keeping the server’s outward network footprint minimal.
Decoding Hidden Payloads: Steganography and Cryptographic Mechanics
Once the text within the comment container is collected, it undergoes a complex extraction routine designed to reverse steganography—the practice of concealing a secret message within a completely ordinary, non-secret file or text document. To the naked eye, the comments on these Steam profiles appear as harmless ASCII art or typical text comments. However, hidden between the visible characters are strings of specialized invisible Unicode characters. The decoder specifically filters for a set of six unique invisible characters:
\u{200C}(Zero-width non-joiner)\u{200D}(Zero-width joiner)\u{2061}(Function application)\u{2062}(Invisible times)\u{2063}(Invisible separator)\u{2064}(Invisible plus)
The execution code strips away every visible letter and symbol, leaving an array consisting entirely of these hidden markers. The decoding engine iterates through this invisible sequence, mapping each distinct character to a numeric index value from 0 to 5. These numerical values are then systematically mapped into a binary format where each element represents exactly 2 bits of space. By reconstructing full bytes from this binary stream, the malware applies a bitwise NOT operation (~byte & 0xFF) to invert the data bits, revealing the final output data string. In scenarios where non-printable binary strings remain, a fallback gzip decompression wrapper is applied to unpack the text.
The malware framework also includes an optional high-grade cryptographic layer for environments where payloads require additional security wrapping. When enabled, this layer extracts an 8-byte initialization salt and a 32-byte Hash-based Message Authentication Code (HMAC) directly from the front of the decoded byte sequence. It derives a complex cryptographic key through the Password-Based Key Derivation Function 2 (PBKDF2) using the SHA-512 hashing algorithm over 10,000 intensive iterations. This derived key material yields a 16-byte initialization vector (IV) and a 32-byte structural key to decrypt the payload utilizing the AES-256-CTR (Counter Mode) cipher block standard. To ensure the code has not been altered or intercepted in transit, a strict validation check is completed by executing an HMAC-SHA256 calculation verified with a time-constant string comparison function (hash_equals), protecting the transmission from timing attacks.
The resulting plaintext translates directly into an external distribution URL, such as hxxps://hello-mywordl[.]info/js/lodash[.]core[.]min[.]js. This URL is instantly fed into the native WordPress core script registry via the wp_enqueue_script() hook under the misleading handle alias asahi-jquery-min-bundle. By mimicking the popular JavaScript utility library Lodash, it runs completely unnoticed on the site’s frontend layout, executing arbitrary code inside user browsers.
The Server-Side Hook: Maintaining Persistent Remote Code Execution
Parallel to the front-facing JavaScript injection is a hardened, server-side persistence architecture that turns the infected site into a remotely controllable shell environment. The malware maps into the WordPress engine by adding a structural hook directly into the template_redirect execution phase, which triggers immediately before WordPress decides which theme template to render for a request. The logic handles incoming HTTP POST requests, monitoring for the presence of specific authentication tokens stored within incoming cookie headers.
By analyzing the headers, the routine bifurcates into two distinct operations based on the exact cookie structure supplied by the attacker. If the incoming payload presents a cookie named DEpjndDbNc, the backend clears out all output buffers using ob_clean() and issues a standard ping or keepalive confirmation response to the attacker. If the incoming connection serves a cookie matching tEcaKKXEsb, the malware initiates an advanced file modification script.
This functionality processes base64-encoded PHP sequences sent through POST variables, enabling direct Remote Code Execution (RCE). Rather than writing completely new files that could easily trip system file-integrity monitors, the command module performs regex search-and-replace processes inside existing, valid plugin and theme files. This allows attackers to seamlessly stitch malicious functions directly inside standard core files, giving them permanent administrative mastery over the filesystem without breaking any active layout components on the public site.
Defensive Strategies and Remediation for WordPress Administrators
Mitigating this specific structural threat requires webmasters and security operations engineers to move past basic perimeter firewalls and look deep into file integrity layers. Because the payload delivery mechanism is hosted on a highly trusted platform (steamcommunity.com), blocking the connection at the external firewall level can cause unintended disruptions if your environment uses community integrations. Instead, teams should implement continuous core file integrity verification protocols to identify additions hooked to key execution states like template_redirect or wp_enqueue_scripts. System administrators can run a targeted command-line scan across their server directories to discover hidden implementations of these custom cookie authenticators:
Bash
grep -rE "DEpjndDbNc|tEcaKKXEsb|asahi-jquery-min-bundle" /path/to/wordpress/
Additionally, database administrators must audit active WordPress options tables for unexpected transient records starting with the prefix caption_. Because these transient fields store the extracted steganographic HTML strings pulled from Steam profile comments, clearing out unidentified components from the database will break the active attack pipeline. Enforcing rigid file permission rules—such as setting standard directory permissions to 755 and core files to 644—prevents the server-side backdoor from effortlessly writing payload adjustments into dormant theme or plugin folders.
Our Opinion on This Case
This specific malware campaign highlights a profound architectural shift in modern web-based cyberattacks. By utilizing the comment infrastructure of Valve’s Steam Community platform, the threat actors have demonstrated how easily the security industry’s reliance on domain reputation scoring can be turned against itself. Security systems are structurally engineered to allow web requests to high-authority domains like Steam without second thought; blocking Valve outright on a corporate network would disrupt thousands of legitimate processes, making complete platform isolation a business impossibility.
What makes this campaign deeply fascinating from an engineering standpoint is its reliance on multi-tiered concealment. The use of invisible Unicode steganography combined with optional PBKDF2 key derivation and AES-256-CTR encryption is a level of tactical mathematical layering typically reserved for advanced persistent threats (APTs), rather than generalized WordPress script injection bots.
By leveraging native WordPress hooks like template_redirect and hiding within standard transient caching functions, the attackers have effectively created a self-healing, phantom infrastructure. The real lesson here is clear: standard perimeter security is losing its efficacy. If a system cannot validate the logical behavior of text inside its own execution chain, it will remain fundamentally exposed to adversaries who use the internet’s most trusted giants as their personal camouflage.
