WordPress Malware Strain SC Leverages Ethereum Gateways for Persistent Command Channels

A resilient WordPress malware strain named SC is utilizing public Ethereum remote procedure call (RPC) gateways to maintain persistent command-and-control channels. The malware lists approximately 20 public Ethereum RPC gateways to query decentralized smart contracts for instructions, circumventing centralized server takedowns. SC stores redundant copies across at least eight locations, including core files, databases, and memory, allowing it to rebuild itself after partial cleanups. Its capabilities include harvesting administrative session tokens, deleting security plugins, and injecting payment-skimming JavaScript, though researchers confirm no direct operational threat to the Ethereum network itself.