TRUST#GRAFT Attack Abuses Logged-In WordPress Admins to Install Hidden Backdoors
A new attack chain, dubbed TRUST#GRAFT, leverages active administrator sessions in WordPress to install PHP backdoors without requiring the admin password, bypassing standard security measures.
Researchers have identified a sophisticated attack chain, named TRUST#GRAFT, that exploits logged-in WordPress administrator sessions to secretly install PHP backdoors on websites. This method bypasses the need for administrator credentials by tricking the administrator's own browser into performing the malicious actions. The attack chain was detailed by Securonix Threat Research analysts Akshay Gaikwad and Aaron Beardslee.
The TRUST#GRAFT attack begins when a logged-in WordPress administrator visits a compromised webpage. The attacker's malicious JavaScript loader on this page then intercepts the administrator's browser session. Instead of attempting to steal credentials or exploit a direct login vulnerability, the script uses the existing authenticated session to upload and activate a malicious plugin. This is particularly concerning as many administrators keep their WordPress dashboard open in the same browser used for daily browsing, making them susceptible to such session hijacking techniques.
Once the administrator's browser is compromised, the script presents a fake security check, often mimicking a Cloudflare "Just a moment" verification screen. While the user is engaged with this fake verification, the script gathers browser and system information, including screen size, timezone, and installed plugins, while also checking for signs of automated analysis tools. Upon successful completion of a small puzzle, the browser communicates with a controller server, which then determines the next stage of the attack.
The critical phase involves the script requesting the WordPress plugin upload page. It leverages the administrator's active login cookies to bypass authentication and then extracts a WordPress security token, known as a nonce. Using these credentials, the script downloads a ZIP file, typically named wm.zip, from a staging server and uploads it through the standard WordPress plugin installation endpoint. The plugin is then activated, all while WordPress perceives these actions as legitimate requests originating from an authenticated administrator.
The uploaded ZIP file contains a PHP plugin disguised as a legitimate tool, such as "Web Media Optimizer." However, this plugin functions as a backdoor, capable of injecting remote JavaScript into public pages, disabling TLS certificate checks for controller script fetches, and even setting administrator login cookies using a hardcoded token. This allows attackers to maintain persistent access and control over the compromised website.
A key element of the TRUST#GRAFT attack's stealth is its persistence mechanism. Upon activation, the malicious plugin copies itself into the wp-content/mu-plugins/ directory, which WordPress automatically loads as "must-use" plugins. Files in this directory are not visible on the standard WordPress Plugins page, making them extremely difficult for administrators to detect and remove through conventional means. This hidden location ensures the backdoor remains active even if the initially uploaded plugin is deleted.
Securonix emphasizes that TRUST#GRAFT is not a login bypass vulnerability; it requires an existing administrator account with plugin installation privileges. However, the attack highlights the significant risks associated with browsing untrusted websites while logged into administrative interfaces. To mitigate such threats, Securonix recommends using a separate browser profile for WordPress administration, signing out of the dashboard after suspicious activity, regularly rotating administrator credentials, and implementing strict monitoring for new PHP files within the mu-plugins directory.
The indicators of compromise (IoCs) provided by Securonix include various JavaScript loader URLs, the wm.zip payload, controller server domains and API paths, and SHA256 hashes for the malicious JavaScript files. These IoCs are crucial for security teams to detect and block the TRUST#GRAFT attack chain and similar threats targeting WordPress environments.