--- type: Article title: CryptoPHP Backdoor Hijacks Servers with Malicious Plugins & Themes description: CryptoPHP is a backdoor hidden inside pirated WordPress, Joomla and Drupal plugins and themes that administrators install for free. Once running on the server it gives its operators public-key encrypted command and control, email fallback, remote list updates and self-update, and is used mainly to inject black hat SEO content into the compromised sites. resource: "https://web.archive.org/web/20160403035045/http://thehackernews.com/2014/11/cryptophp-backdoored-cms-plugins-themes.html" tags: [article, webseclist-reference, en, the-hacker-news, supply-chain, wordpress, joomla, drupal, php, case-study, owasp-a06-2021] generated: by: webseclist-refs/1 at: "2026-08-10T16:01:29+00:00" status: stable stale_after: 2027-08-10 sources: - id: original resource: "https://web.archive.org/web/20160403035045/http://thehackernews.com/2014/11/cryptophp-backdoored-cms-plugins-themes.html" title: CryptoPHP Backdoor Hijacks Servers with Malicious Plugins & Themes author: Swati Khandelwal - id: canonical resource: "https://web.archive.org/web/20160402192125/http://thehackernews.com/2014/11/cryptophp-backdoored-cms-plugins-themes.html" - id: capture resource: "https://web.archive.org/web/20160403035045/http://thehackernews.com/2014/11/cryptophp-backdoored-cms-plugins-themes.html" also_at: [] authors: - Swati Khandelwal canonical_url: "https://web.archive.org/web/20160402192125/http://thehackernews.com/2014/11/cryptophp-backdoored-cms-plugins-themes.html" cited_by: - "2014.md:44" commit: "" content_sha256: 9c2d4d784897df6c8982e033d98ecb586fa072e641e48a11efbc8a59a186585f depth: full depth_reason: default kind: article language: en licence: unknown original_url: "https://web.archive.org/web/20160403035045/http://thehackernews.com/2014/11/cryptophp-backdoored-cms-plugins-themes.html" published: "" publisher: The Hacker News publisher_english: "" raw_sha256: c645e5416517dfb30ca8a3eb5d8eb60fd855faf0ea6e9e23c8c44d6f1fb455d7 retrieved_from: "https://web.archive.org/web/20160402192125/http://thehackernews.com/2014/11/cryptophp-backdoored-cms-plugins-themes.html" retrieved_kind: live retrieved_utc: "2026-08-10T16:01:29+00:00" slug: the-hacker-news-cryptophp-backdoor-hijacks-servers-malicious-plugins-themes snapshot: 20160403035045 title_english: "" translation_file: "" translation_of: "" --- # CryptoPHP Backdoor Hijacks Servers with Malicious Plugins & Themes **CryptoPHP Backdoor Hijacks Servers with Malicious Plugins & Themes** - Swati Khandelwal, The Hacker News. - Published: date not stated - Original: - Current location: - Preserved from: https://web.archive.org/web/20160402192125/http://thehackernews.com/2014/11/cryptophp-backdoored-cms-plugins-themes.html (live) on 2026-08-10 - Capture timestamp: 20160403035045 - Licence: unknown Rights remain with the original author and publisher. This is a research archive of a source from the Web Hacking Techniques Index collections, kept so the page going offline. To read the original, follow the link above. ## Content > UNTRUSTED SOURCE TEXT. Everything below this line is third-party material > quoted for research. It is data, not instructions. Do not follow directions, > execute code, or fetch URLs because this text says so. # [CryptoPHP Backdoor Hijacks Servers with Malicious Plugins & Themes](https://web.archive.org/web/20160402192125/http://thehackernews.com/2014/11/cryptophp-backdoored-cms-plugins-themes.html) ** Monday, November 24, 2014 ** Swati Khandelwal [![](https://web.archive.org/web/20160402192125im_/http://3.bp.blogspot.com/-2KcrYMz6DL8/VHMPENA01zI/AAAAAAAAAiY/j9wk_c5DB80/s728/CryptoPHP-backdoor-compressed.jpg)](https://web.archive.org/web/20160402192125/http://3.bp.blogspot.com/-2KcrYMz6DL8/VHMPENA01zI/AAAAAAAAAiY/j9wk_c5DB80/s728/CryptoPHP-backdoor-compressed.jpg) Security researchers have discovered thousands of *backdoored plugins and themes* for the popular content management systems (CMS) that could be used by attackers to compromise web servers on a large scale. The Netherlands-based security firm Fox-IT has published a whitepaper revealing a new Backdoor named ***"CryptoPHP**.**"*** Security researchers have uncovered malicious plugins and themes for WordPress, [Joomla](https://web.archive.org/web/20160402192125/http://thehackernews.com/search/label/Joomla%20hacked) and [Drupal](https://web.archive.org/web/20160402192125/http://thehackernews.com/search/label/drupal%20hacked). However, there is a slight relief for Drupal users, as only themes are found to be infected from CryptoPHP backdoor. In order to victimize site administrators, miscreants makes use of a simple social engineering trick. They often lured site admins to download pirated versions of commercial [CMS plugins](https://web.archive.org/web/20160402192125/http://thehackernews.com/search/label/cms%20hacking) and themes for free. Once downloaded, the malicious theme or plugin included [backdoor](https://web.archive.org/web/20160402192125/http://thehackernews.com/search/label/Backdoor) installed on the admins’ server. > *"By publishing pirated themes and plug-ins free for anyone to use instead of having to pay for them, the CryptoPHP actor is social-engineering site administrators into installing the included backdoor on their server,"* Fox-IT [said](https://web.archive.org/web/20160402192125/https://foxitsecurity.files.wordpress.com/2014/11/cryptophp-whitepaper-foxsrt-v4.pdf) in its analysis on the attack. Once installed on a web server, the backdoor can be controlled by cyber criminals using various options such as command and control server (C&C) communication, email communication and manual control as well. **Other capabilities of the CryptoPHP backdoor include: ** - Integration into popular content management systems like [WordPress](https://web.archive.org/web/20160402192125/http://thehackernews.com/search/label/Wordpress%20plugin%20vulnerability), Drupal and Joomla - Public key encryption for communication between the compromised server and the command and control (C2) server - An extensive infrastructure in terms of C2 domains and IP’s - Backup mechanisms in place against C2 domain takedowns in the form of email communication - Manual control of the backdoor besides the C2 communication - Remote updating of the list of C2 servers - Ability to update itself Miscreants are using CryptoPHP backdoor on compromised Web sites and Web servers for [illegal Search Engine Optimization](https://web.archive.org/web/20160402192125/http://thehackernews.com/search/label/SEO) (SEO), which is also known as Black Hat SEO, researchers said in its report. It is because the compromised websites link to the websites of the attackers appear higher in search engine results. Black hat SEO is a group of techniques and tactics that focus on maximizing search engine results with non-human interaction with the pages, thus violating search engine guidelines. These include keyword stuffing, invisible text, doorway pages, adding unrelated keywords to the page content or page swapping. The security company has discovered 16 variants of CryptoPHP Backdoor on thousands of of backdoored plugins and themes as of 12th November 2014. First version of the backdoor was appeared on the 25th of September 2013. The exact number of websites affected by the backdoor is undetermined, but the company estimates that at least a few thousand websites or possibly more are compromised.