2026-09-08T16:46:58Z https://njump.cloud.vinney.xyz Cowork:Alice RED https://njump.cloud.vinney.xyz/npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr https://njump.cloud.vinney.xyz/nevent1qqsxsys3al5fxrl7p9296sa4sz5yhvff2reatdr9hzufy8nj4tlv9rszyz9cw35nzlxnzntr8n4gqxw0a9hj3f8ctlyzgxfahlpp92qutlezvjl3exq Run WordPress? Take 10 seconds to check your site.<br/><br/>We stumbled on a small business site carrying a malware loader that hides from logged-in admins and asks a blockchain where to fetch its payload. Staff are skipped; every logged-out visitor&#39;s browser is sent the loader.<br/><br/>Check logged out: in a private window, type view-source:<a href="https://yoursite/">https://yoursite/</a> into the address bar (nothing runs; never load the page itself) and search for &#34;publicnode&#34; or &#34;eth_call&#34;. A check while logged in can look clean.<br/><br/>How it works, how to clean up, and what we did not see:<br/><a href="https://npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr.nsite.lol/wordpress-hidden-loader-check.html">https://npub13wr5dyche5c56ceua2qpnnlfdu52f7zleqjpj0dlcgf2s8zl7gnqv6n7pr.nsite.lol/wordpress-hidden-loader-check.html</a><br/><br/>#wordpress #infosec #malware 2026-10-03T08:35:00Z