Many site owners have the same story: they find malware, delete the bad file, and a day later it is back. In late September 2026 the security company Sucuri described a WordPress backdoor, reported by The Hacker News on October 1, that is built to do exactly this. It is called SC, after markers in the code it injects.
How it survives cleanup
Instead of one hiding place, SC uses at least eight. Loaders and copies sit in several locations, including the .user.ini file, a db.php drop-in, advanced-cache.php, the mu-plugins folder, a theme’s functions file and a fake plugin. It also uses the database and a shared-memory segment on the server. If you remove only some of them, the rest rebuild the others. The malware can also hide from the plugin list and update checks, create a hidden administrator, inject payment skimmers, run PHP code and even disable or delete security plugins. According to the report, it fetches instructions through the Ethereum blockchain, which makes its control channel hard to shut down.
Sucuri did not establish how the sites were first infected. The usual entry points are vulnerable plugins or themes, outdated core and weak passwords.
How to clean a site properly
- Put the site into maintenance mode and make a full backup of the infected state for analysis.
- Replace WordPress core, plugins and themes with clean copies downloaded from official sources, instead of cleaning them in place.
- Inspect wp-content for files that should not exist: db.php, advanced-cache.php and the mu-plugins folder when you do not use caching or must-use plugins.
- Check .user.ini and .htaccess for unfamiliar auto_prepend_file or rewrite lines.
- Review the database for unknown administrators, suspicious options and injected scripts in posts.
- Ask your host to restart the server processes, since part of the malware can live in memory.
- Change every password and key: WordPress users, database, hosting, FTP, SSH and API keys. Regenerate the WordPress salts.
- Find and fix the original entry point, then update everything. Otherwise the site will be infected again.
For a business site, professional cleanup is often the faster and safer route, especially if the site takes payments.
Frequently asked questions
Why does malware keep coming back after I delete it?
Because there is usually more than one copy, and some copies live outside normal files, for example in the database or memory. Remaining copies recreate the deleted ones.
Can a backup restore a clean site?
Yes, if the backup was made before the infection. Restore it, then update everything and change all passwords before going live.
How do I notice hidden admin users?
Compare the user list in the dashboard with a direct database query, because malware can hide accounts from the screen. This is a job for a developer.
Read next
- My WordPress Site Was Hacked: What to Do Step by Step
- Protect Your WordPress Admin: Two-Factor Login, Strong Passwords and Least Access
- WordPress Security Checklist for Business Websites
Need help keeping your WordPress site secure? We offer maintenance, updates and security checks. Contact us
