Guide · Malware campaigns
Balada Injector and SocGholish are the two longest-running campaigns that used compromised WordPress sites against their own visitors. Balada redirected them to scams; SocGholish showed them a fake browser update that installed malware used as a first step to ransomware. Both are weaker in 2026 than they were: Balada effectively stopped after its traffic network was disrupted in late 2024, and SocGholish lost 106 servers and domains to a police operation in June 2026. Neither fact cleans a site. The code they planted stays until someone removes it, and on an infected site it keeps loading whatever now answers at the old domains.
Published Last reviewed
Where they stand in 2026
Balada Injector is a name for one operator’s work over many years. Sucuri, whose researcher Denis Sinegubko has documented it since 2017, estimated in 2023 that it had infected more than a million WordPress sites, recognisable by its taste for String.fromCharCode obfuscation and by waves of new infections every couple of weeks. Its counts in Sucuri’s SiteCheck scanner were 100,470 sites in the first half of 2024 and 149,351 across the year. GoDaddy’s annual report, published in June 2026, puts 2025 at 11,701, roughly a tenth, and says the operation “effectively ceased” after the VexTrio traffic network it sold visitors to was disrupted in late 2024. Most of its domains expired during 2025. Some were re-registered by spammers, so a site that still carries Balada code now sends its visitors to whoever bought the domain.
SocGholish, also called FakeUpdates, is older and more dangerous to visitors. MITRE describes its operator, tracked by Proofpoint as TA569 and by Microsoft as Mustard Tempest, as an initial access broker active since at least 2017 whose victims have been handed on to ransomware groups. On 18 June 2026, Operation Endgame, led by the Dutch police with the FBI, the RCMP, Germany’s BKA, Europol and Eurojust, took down 106 of its servers and domains and remediated 14,971 compromised WordPress sites. Shadowserver’s report on the data counted 1,441,695 compromised WordPress instances that the network could use between May 2023 and May 2026. Proofpoint expects the separate operator that filters and routes the traffic, TA2726, to be largely unaffected.
How they get in
Its best-documented waves used stored cross-site scripting flaws that run in an administrator’s browser: tagDiv Composer, the Newspaper theme’s companion plugin, in 2023 (CVE-2023-3169, fixed in 4.2), and Popup Builder in December 2023 (CVE-2023-6000, versions 4.2.3 and older). Earlier waves used old Newspaper and Newsmag bugs, Ultimate Member, Elementor Pro, WP GDPR Compliance, Adminer and TimThumb.
Sucuri catalogued 122 ways it tried to read wp-config.php, including backup copies such as .bak and .swp files, plus brute force and user enumeration through the REST API. Database credentials taken this way let it return after the plugin was patched.
The recurring pattern in Sucuri’s logs is a login with real credentials, then the plugin upload screen, then activation of a tampered copy of a genuine plugin. The Dutch CSIRT’s instructions to 2026 victims open with “Your WordPress administrator credentials have been stolen.”
Balada’s infector scripts climb directories looking for other sites’ writable files, and one 2024 helper injected neighbouring sites’ wp-blog-header.php. One infected site on a shared account is a reason to inspect all of them.
What they leave behind
These are the artefacts the researchers published. Names rotate between waves, so treat a hit as confirmation and a miss as inconclusive; the places are more stable than the strings.
Two habits defeat most first looks. Both campaigns skip visitors who are logged in as administrators, so the infected page looks normal to the person checking it; view the source logged out, from a private window or a different browser profile. And both hide their plugins from the Plugins screen, so the list in the dashboard is not evidence; the folder on disk is.
Figure 1 · Markers to search for
Two campaigns, one rule: search the files, the database and the plugin folder, not the dashboard.
| Marker | Where it lives | Campaign |
|---|---|---|
| String.fromCharCode loader | JS files, theme files, options, posts | Balada |
| td_live_css_local_storage | wp_options (tagDiv Newspaper sites) | Balada |
| sg_popup_scripts · hook_csssss | wp_postmeta · wp-blog-header.php | Balada |
| wp-zexit · wp-swamp · wp-felody | Hidden plugin folders | Balada |
| if(ndsw===undefined) · zqxw | End of inline or .js scripts | SocGholish |
| Tampered plugin via upload-plugin | wp-content/plugins after a login | SocGholish |
| Artefact | Where | Source |
|---|---|---|
| A script stored in the td_live_css_local_storage option and printed inside a tdw-css-placeholder style tag | wp_options, on sites with tagDiv’s Newspaper theme | Sucuri, October 2023 |
| Code prepended to wp-includes/js/jquery/jquery.min.js and other .js files | Core and plugin JavaScript | Sucuri, 2023 |
| Administrators named greeceman, or a name built from the hostname ending in “mann” with an @mail.com address | wp_users | Sucuri, October 2023 |
| A backdoor in the theme’s 404.php that runs code sent in a POST parameter named ii | Theme files; POST requests answered with 404 in the logs | Sucuri, October 2023 |
| Self-hiding plugins wp-zexit, wp-swamp and wp-felody | wp-content/plugins, absent from the Plugins screen | Sucuri, 2023 and January 2024 |
| Script in Popup Builder’s custom JS box, stored as sg_popup_scripts; a hook_csssss function added to wp-blog-header.php | wp_postmeta; the site root | Sucuri, January 2024 |
| An inline loader beginning if(ndsw===undefined), later with names such as zqxw and zqxq | End of inline scripts such as wp-emoji, or of .js files, with a PHP proxy in a random folder | Sucuri, June 2024; GoDaddy, 2026 |
| A tampered copy of a real plugin uploaded as a zip through update.php?action=upload-plugin | wp-content/uploads and wp-content/plugins, minutes after a login | Sucuri, March 2024 |
Find it
Read-only searches, run from the site’s root over SSH. The commands are this site’s own; the researchers published the strings, not the commands. Adjust the wp_ table prefix to your own.
Matches in core or plugin JavaScript are the strongest signal, because those files never need these strings:
grep -rlE 'String\.fromCharCode|ndsw===undefined|zqxw|hook_csss|tdw-css-placeholder' --include='*.js' --include='*.php' --include='*.html' . | head -50Some legitimate libraries use String.fromCharCode; a long run of numbers passed to it at the very top or bottom of a file is the pattern to look at.
Options, post meta and posts are where both campaigns keep the script that reaches visitors:
wp db query "SELECT option_name, LENGTH(option_value) FROM wp_options WHERE option_name = 'td_live_css_local_storage' OR option_value LIKE '%fromCharCode%' OR option_value LIKE '%ndsw%'"
wp db query "SELECT post_id, meta_key FROM wp_postmeta WHERE meta_key = 'sg_popup_scripts' OR meta_value LIKE '%<script%' LIMIT 50"Check siteurl and home while you are there; a changed value is how some waves sent the whole site elsewhere.
List what is on disk, then what WordPress reports with every plugin skipped so a hiding filter cannot run:
ls -la --time-style=long-iso wp-content/plugins wp-content/mu-plugins
wp plugin list --skip-plugins --skip-themes --fields=name,status,versionA folder that WordPress does not list, a plugin with a .DS_Store file inside, or a copy of a well-known plugin with a recent folder date is the thing to open.
Hidden administrators are how both campaigns return:
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --skip-plugins --skip-themesLook for greeceman, names ending in “mann”, @mail.com addresses, and any account registered on a date nobody can explain.
A plugin upload seconds after a login, with no visit to the login page first, is SocGholish’s signature; POST requests answered with 404 point at Balada’s 404.php backdoor:
grep -E 'upload-plugin|plugin-install\.php|/wp-json/tdw/save_css' /path/to/access.log | tail -50Remove it
Copy the access logs, a database dump and the plugin, mu-plugin and theme folders off the server before changing anything. The upload times and the rogue accounts are what tell you how far back to look.
Change every WordPress administrator password from a clean device, and the database, SFTP, SSH and hosting-panel passwords, because both campaigns work from stolen credentials. Generate new salts in wp-config.php so existing sessions end. Check the administrators’ own computers for password-stealing malware; a new password typed on an infected laptop is a new stolen password.
The injected loaders in files, the stored payloads in options, post meta and posts, the hidden and tampered plugins, the backdoors in theme files, the uploads folder, and the rogue administrators. Delete plugins and themes you do not use; deactivating them leaves the code in place.
Reinstall core with the checksum-verified release and plugins from their official sources, so nothing you missed survives in a file you edited by hand.
wp core verify-checksums --skip-plugins --skip-themes
wp plugin verify-checksums --all --skip-plugins --skip-themesChecksums cover only code published on WordPress.org; premium plugins, custom themes, uploads and the database still need reading.
Inspect every other site in the same hosting account, update or remove the plugin that let them in, add DISALLOW_FILE_EDIT to wp-config.php, block PHP execution in uploads, and turn on two-factor authentication for every administrator.
Load the site logged out, from a private window and a phone, and read the source of the first page. When nothing loads from an unknown domain, request reviews in Google Search Console and Bing Webmaster Tools if either flagged the site.
Related campaigns
The three get confused because all of them use a compromised WordPress site to show visitors something false. Balada sold redirects: the visitor ended up on push-notification spam or a tech-support scam. SocGholish sells access: the fake update installs a loader on the visitor’s computer, and the access is passed on. ClickFix, which GoDaddy dates to 2024 as a replacement for fake update prompts, shows a fake CAPTCHA that tells the visitor to paste a command into their own computer. Balada itself used fake-CAPTCHA lures between December 2024 and February 2025, near the end of its run.
For the site owner the difference matters less than the overlap: valid administrator logins, fake plugins, scripts that hide from administrators, and persistence in several places at once. The cleanup is the same shape for all three.
Sources
Compiled on 5 November 2026. Figures are quoted as each source reported them, with its date, and were not re-measured. The sources disagree on some details: SocGholish’s start is given as 2017 by MITRE and as April 2018 by Red Canary, and the December 2023 Popup Builder wave is counted at 6,200, 6,700 and over 7,100 sites by different outlets. The search commands are this site’s own; none of the sources publish WP-CLI commands for these campaigns.
Common questions
Yes. The operation stopped; the code on infected sites did not. GoDaddy reports that some of Balada’s expired domains were re-registered by spammers, so an infected site now sends its visitors to whoever owns them, and the hidden plugins and administrators that came with the infection still work.
Not by itself. Operation Endgame took down 106 servers and domains and remediated 14,971 sites; Shadowserver counted over 1.4 million compromised instances the network could use. If your site carries a SocGholish loader or a tampered plugin, it still needs removing, and the stolen administrator credentials that put it there still need changing.
Both campaigns skip logged-in administrators, and SocGholish also skips visitors it has seen before and waits for signs of a real person, such as mouse movement. View the source logged out, in a private window or a different browser, or on a phone using mobile data.
Their computer is the urgent part. Disconnect it from the network and have it examined: Red Canary saw follow-on malware such as remote-access tools and information stealers in about a quarter of 2025 SocGholish incidents. Then treat any password typed on it as stolen.
No. The update closes the door the campaign came in by. The loaders, the stored scripts, the hidden plugins, the backdoors and the administrators it created are all still there afterwards, and so are any credentials it read.
Yes. Sucuri documented Balada scripts that climb the file system to infect neighbouring sites’ files. One site found infected on a shared account is a reason to inspect every site that account can write to.