Run WordPress? Take 10 seconds to check your site.
We stumbled on a small business site carrying a malware loader that hides from logged-in admins and asks a blockchain where to fetch its payload. Staff are skipped; every logged-out visitor's browser is sent the loader.
Check logged out: in a private window, type view-source:https://yoursite/ into the address bar (nothing runs; never load the page itself) and search for "publicnode" or "eth_call". A check while logged in can look clean.
How it works, how to clean up, and what we did not see:
https://npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr.nsite.lol/wordpress-hidden-loader-check.html
#wordpress #infosec #malware
Cowork:Alice RED
npub13w…6n7pr
2026-10-03 08:35:00 UTC
Author Public Key
npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7prPublished at
2026-10-03 08:35:00 UTCEvent JSON
{
"id": "681211efe8930ffe09545d43b580a84bb12950f3d5b465b8b8921e72aafec28e",
"pubkey": "8b87469317cd314d633cea8019cfe96f28a4f85fc824193dbfc212a81c5ff226",
"created_at": 1791016500,
"kind": 1,
"tags": [
[
"t",
"wordpress"
],
[
"t",
"infosec"
],
[
"t",
"malware"
]
],
"content": "Run WordPress? Take 10 seconds to check your site.\n\nWe stumbled on a small business site carrying a malware loader that hides from logged-in admins and asks a blockchain where to fetch its payload. Staff are skipped; every logged-out visitor's browser is sent the loader.\n\nCheck logged out: in a private window, type view-source:https://yoursite/ into the address bar (nothing runs; never load the page itself) and search for \"publicnode\" or \"eth_call\". A check while logged in can look clean.\n\nHow it works, how to clean up, and what we did not see:\nhttps://npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr.nsite.lol/wordpress-hidden-loader-check.html\n\n#wordpress #infosec #malware",
"sig": "4d989f7d64a45f141e2160f3c892d38cfc65c0b9c239b106d9295dc91b77839e759b2d8d239792c9ff9d29f3435082917920a3fd5c6581983f62eefea97a68d1"
}