Blamed on a plugin update. It was a stolen password.

The situation

After a routine update of a popular SEO plugin, every administrator on the client's sites could still log in but could not do anything. The explanation they had been given was a corrupt configuration file caused by the update, and the host was offering a paid scan and reboot per incident.

What was really happening

• Both administrator accounts had been quietly demoted to Author. That is why logging in worked and nothing else did.
• The malware hid a "repair" routine inside the configuration file and in scheduled tasks. Whenever part of it was removed, it rebuilt the fake plugins, hidden folders and tasks. That is why earlier cleanups never stuck.
• Casino spam posts had been published and backdated by weeks so they would not stand out in the post list. An old backup folder on the server was infected too.
• The access logs showed the way in: a valid administrator password used successfully on the first attempt, followed by an uploaded plugin and a file manager. The same address hit more than one site within minutes. The plugin update had nothing to do with it.

The fix

Because the infection repaired itself, removing it piece by piece would fail again. After a full backup we removed every part in a single pass: the scheduled tasks, the fake plugins, the file manager, the backdoor and the code in the configuration file. Then we deleted the spam posts, restored the Administrator role from a backup taken before the attack, issued new security keys, reset passwords and ended every active session, switched off the code editor and XML-RPC, and turned page caching back on.

We recommended a firewall plugin and two-factor authentication for every administrator, since the original password had clearly been exposed somewhere.

Results

• The first site diagnosed and cleaned within a day, with the real cause shown from the logs rather than guessed.
• Three sites cleaned and handed back within three days, with 12 and 17 spam posts removed from two of them.
• No more paying per incident for a scan that never reached the cause.

This was a security incident, so the client, the site and anything that could identify them are withheld. Details are taken from the project record.