After the Hack: What ‘Cleanup’ Really Means for WordPress Sites with Francesco Carlucci

Robert Abela: Thanks everyone for joining this week’s episode with Francesco Carlucci. Hello, Francesco. How are you?

Francesco Carlucci: Hello, Robert. Hello again. Thanks for having me.

Robert Abela: You’re welcome. It’s nice to have you. You bring a lot of knowledge. In fact, before we started, we were talking about AI. We’ll definitely mention it more today. As we were saying, we have much more to discuss in the future.

We invited you because we were talking a few days ago, and you mentioned a very interesting case. You were involved in cleaning up a hacked website. It was a large corporate website, and there’s an interesting story involving polymorphic malware and it wasn’t detected by the usual means. Let’s start from the beginning. When you’re asked to clean up a hacked website, what is the typical process? There’s a lot going on beyond just removing the infection.

Francesco Carlucci: In this specific case, we weren’t initially asked to clean up a hacked website. With large corporations, things work a bit differently. The company I was consulting for as a cybersecurity professional received a ticket from the client’s marketing department. They noticed something strange on the website and suspected that something was off. They asked us to look into it.

The alert actually came from ChatGPT, which was performing an SEO analysis. It was analyzing markup and content for marketing purposes, not for security. The AI model detected something unusual. The marketing team became concerned and opened a ticket with the IT provider, and that’s when I was brought in to investigate. That’s when I realized there was malware on the website.

ChatGPT found content injected into the DOM, inside the HTML markup. The content appeared consistent with the website’s topic, but it linked to a suspicious website. That immediately suggested classic SEO spam, injecting content that links to malicious websites to either redirect visitors or improve the ranking of another site.

Robert Abela: When someone discovers something like this, they can use automated cleanup services or engage someone like you. What’s the main difference between automated cleanup and working with a security professional?

Francesco Carlucci: Automated cleanup can be very useful. Even as a professional, I use tools to automate tasks, especially on large websites where manually reviewing thousands of pages is impossible.

However, automated scanners typically rely on deterministic detection. They look for known signatures, essentially fingerprints of known malware. These signatures are stored in large databases. If malware matches a known pattern or appears obfuscated, it gets flagged.

This approach worked well in the past. But things are changing. In this case, even professional tools failed to detect the malware. Modern malware can be polymorphic; it adapts itself to the target. It changes form, making it harder to detect with signature-based systems.

Polymorphic malware means the content changes depending on the infected site. If the website is about sports, the injected content references sports. If it’s about kitchenware, the malicious content blends into that context. Large language models make generating these variations extremely easy. You can generate different versions of malware tailored to each target.

In this case, the malware had been present for over a year without detection.

The advantage of involving a professional is human reasoning. You can think beyond signatures and use investigative techniques.

Robert Abela: When you’re asked to investigate a site, what’s your first step?

Francesco Carlucci: If it’s a completely new target for me and no logging is already in place, the first step is isolation and backup. I take a full machine-level backup. If it’s on Docker, I back up the entire container. If it’s on a VPS, I back up the full VPS.

When you deal with a compromise, you don’t know at which layer it occurred. There’s the application layer (WordPress), the web server, the operating system, possibly a hypervisor, and even underlying hardware. The issue might not be limited to WordPress.

So, I isolate the full stack as deep as possible. That ensures I have a clean reference point for analysis or rollback.

After backup, I proceed based on evidence. In this case, malicious content injection suggested an application-layer issue: either a vulnerable plugin or leaked credentials.

Because budgets are limited, you must prioritize likely causes. Without proper logging system, identifying the exact root cause is often impossible, especially if the malware has been active for a year.

If there’s no file change logging, I manually inspect the file system. Often, issues appear in the root or in unexpected modified files.

And cleaning the infection is not enough. You must identify and close the entry point. Otherwise, the attacker can reinfect the site.

Robert Abela: In this case, you mentioned it wasn’t a targeted attack. How did you determine that?

Francesco Carlucci: SEO spam usually works at scale. Attackers want to inject many websites to promote malicious domains.

I conducted OSINT research and found unrelated websites infected with the same malware.  That confirmed it wasn’t a targeted attack against this specific company but rather a broad campaign exploiting a vulnerability or leaked credentials. Because the malware was over a year old, logs were no longer available. In such cases, I identify all possible entry points and patch them all.

We checked plugins for known vulnerabilities and verified that plugin files matched official repository versions. 

Other possible causes were leaked credentials or insider misuse. Large corporations often have hundreds of users. The malware was injected using editor privileges, not administrator privileges.

So, we changed all passwords for users with content editing permissions and enabled two-factor authentication. We also tried to determine last login times. WordPress doesn’t store last login by default, but there was a useful clue.

In a recent WordPress release, the password hashing algorithm changed. The new hashes are longer. By checking whether a user’s password was stored with the new hashing format, we could infer whether they had logged in after the change. That allowed us to narrow down potential suspects.

Robert Abela: User management is a major blind spot. 

Francesco Carlucci: It’s extremely common to find accounts belonging to former employees or developers with elevated privileges still active years later.

Robert Abela: In Melapress Login Security, we have checkbox, where you can configure to disable any user that has been inactive for 3 months or longer. And you can see the list of these users and delete them.

Francesco Carlucci: That’s a super useful feature. Basic security hygiene matters: remove inactive users, enforce password policies, implement two-factor authentication, and maintain onboarding/offboarding procedures.

Robert Abela: What do you usually monitor? 

Francesco Carlucci: I monitor file changes, login attempts, content changes, and outgoing HTTP requests. WordPress makes many outbound calls: for updates, license checks, payment gateways, and more. 

Robert Abela: What tools do you use for automated and manual monitoring?

Francesco Carlucci: During an audit, I usually use malware scanner to scan all the files to see if there is any malware on the website.

Robert Abela: You demonstrated how cross-site scripting (XSS) can escalate quickly.

Francesco Carlucci: Yes. I showed a short JavaScript snippet that, if injected via XSS, can fetch a nonce and create a new administrator user. The code itself is simple and not inherently malicious. The difference between good and bad code lies in intent.

Signature-based scanners may not detect such scripts. Even if encryption is used to obfuscate them, detection often flags the encryption rather than understanding the behavior.

With AI-based detection, behavior analysis becomes possible. Instead of matching signatures, AI could analyze intent: detecting keylogging, data exfiltration, unauthorized user creation, and similar actions.

We’re not yet at the stage where you can simply ask AI to audit a website end-to-end without guidance. But you can already build agents that scan databases or file systems using specific prompts.

Robert Abela: You also mentioned blockchain-based command-and-control infrastructure. Can you tell a bit more about?

Francesco Carlucci: Traditionally, attackers compromise legitimate websites to host malicious payloads. These command-and-control servers distribute malware.

In 2025, Google researchers discovered malicious payloads embedded in public blockchain smart contracts. Blockchain networks like Ethereum allow anyone to deploy smart contracts. These contracts can store encoded malicious payloads.

Since blockchains are decentralized and public, they’re extremely difficult to shut down. Attackers can fetch payloads via JavaScript using libraries like web3.js, decode them, and execute them locally. It creates a distributed, resilient command-and-control infrastructure.

Robert Abela: Finally, for website owners, what immediate steps should they take?

Francesco Carlucci: First, if you’re not technically capable of managing your entire stack, use managed hosting.

Second, implement a Web Application Firewall (WAF). You can use server-level firewalls or edge-based solutions such as Cloudflare. Some organizations use both.

Third, use vulnerability scanners to ensure core, themes, and plugins are up to date and free from known vulnerabilities.

Fourth, enforce strong credential hygiene: two-factor authentication, password changes, and removal of inactive users.

These measures significantly reduce exposure to mass automated attacks. Security is not a one-time setup. You patch what’s most likely, then you monitor continuously.

Robert Abela: Thank you, Francesco. It’s always a pleasure discussing these topics.

Francesco Carlucci: Thank you, Robert. It’s always a pleasure. You can find me at francescocarlucci.com or on LinkedIn. I’m currently exploring blockchain and smart contracts while continuing to consult on cybersecurity.