A key WordPress feature has been hijacked to show malicious code, spam images

Person editing a WordPress site.

---

• Researchers from Sucuri found malicious code hiding in the mu-plugins directory
• The malware redirected visitors, served spam, and could even drop malware
• The sites were compromised through vulnerable plugins, poor admin passwords, and more