Forensic Breakdown: CyberPanel SnappyMail Log Exploited to Persist Webshell on WordPress
Patch the wp-config.php file to remove the malicious eval base64_decode payload, then audit server logs for root-level backdoor and apply CyberPanel security updates.
Patch the wp-config.php file to remove the malicious eval line, audit server logs for root‑level backdoor, update CyberPanel to the latest version, and apply server hardening measures.
Summary
A WordPress site owner discovered redirect malware that opened spam links in new tabs and Yandex Metrica requests that could not be found in the code or database. Wordfence audit found no WordPress-level compromise, but a server‑level backdoor was created by turning a SnappyMail log file into a root‑level shell. The attacker injected a single line eval(base64_decode(...)) at the top of wp-config.php, disabling error output and executing only on frontend page loads while excluding admin, REST API, AJAX, login, and XHR requests. The payload then injected a script from //async.gsyndication.com/, a typosquat domain registered on 15 Oct 2024 and linked to 29+ malicious domains. The infection re‑appeared within 2‑6 hours after each cleanup, demonstrating a persistent backdoor that survived WordPress‑level removal.
The forensic analysis revealed a double‑encoded redirect payload: the first layer disables errors, checks request URI conditions, and prints a base64‑decoded script tag; the second layer loads the malicious script. The attacker leveraged the server’s root access to re‑inject the payload, creating a rapid re‑infection cycle that bypassed WordPress security tools.
This case underscores the need for server‑level hardening, timely updates to CyberPanel, and thorough audit of server logs for hidden backdoors, as WordPress‑level cleanup alone is insufficient.
Key changes
- Malware inserted single line eval(base64_decode(...)) at top of wp-config.php
- Payload disables display_errors and display_startup_errors
- Executes only on frontend page loads, excluding admin, REST API, AJAX, login, and XHR
- Injects script src="//async.gsyndication.com/" via double‑encoded payload
- Attack chain uses CyberPanel SnappyMail log file to create root‑level backdoor
- Re‑injection cycle occurs within 2‑6 hours after cleanup
- Linked to 29+ malicious domains, including async.gsyndication.com
- Yandex Metrica requests appear without code in site files