Moatline

Fake WordPress security plugins: a real case from four hacked sites

In October 2026 we cleaned four WordPress sites carrying the same set of fake plugins. One called itself WordPress Defender and sent login details to the attackers. Three of the sites shared one hosting account, so cleaning them one at a time never worked. Here is what we found and how to tell a fake plugin from a real one.

By the Moatline team at Next Nova Technologies · Published 29 October 2026 · 4 min read

This is a real cleanup from October 2026. Three of the sites were client sites on a web agency’s staging account; the fourth was a dental practice’s live site carrying the same malware. We’ve left out the names.

What we found

  • “WordPress Defender” in a folder called wordpress-defender. It captured login details and sent them to interseq[.]at, and stored its settings in database entries starting with wordpress_defender.
  • A fake “White Label CMS” in a folder called white-label. The real plugin is a harmless branding tool; this copy loaded scripts from the loader addresses below and made requests to a wlcms_tokens address.
  • “WordPress Security” (wordpress-security) and “Related Image” (related-image), the second credited to an author called “Billy Gin”, the same name used on the fake White Label CMS.
  • Hidden plugins. Some of these removed themselves from the Plugins screen. They only showed up in the file manager.
  • Code outside the plugins: in the theme’s functions.php, inside a JavaScript file of the Astra theme’s add-on (purify.min.js), and in posts stored in the database.
  • Loader addresses that the scripts fetched more code from: latoem[.]biz, mlroweb[.]com, renotad[.]com and luqiuid91[.]com.

Why the sites kept reinfecting each other

The three staging sites lived in one cPanel account under one system user. On that kind of hosting, a script running on one site can read and change every file of the others. So no site can be cleaned on its own: as long as one neighbour is still infected, it can write the malware back into the rest. All three have to be cleaned at the same time, followed by new hosting and database passwords.

If you keep several sites in one hosting account, treat them as one site when cleaning. Better still, give each site its own account or system user so one break-in stays in one place.

How to spot a fake plugin

  • The folder name doesn’t match the real plugin. Wordfence lives in wordfence, Defender in defender-security, White Label CMS in white-label-cms. Generic names like wordpress-security or wordpress-defender are not official plugins.
  • A security plugin’s folder with a number added, such as wordfence-2. Malware renames real security plugins so they stop running.
  • No readme.txt. Plugins from WordPress.org always have one; most fakes don’t.
  • An odd author: just “WordPress”, a made-up name, or the same name on several unrelated plugins.
  • It’s in the folder but not on the Plugins screen. A plugin that hides is never legitimate.
  • You can’t find it on WordPress.org or on the website of the company it claims to come from.

The free Moatline Malware Scanner checks for all of these, including plugins that hide from the Plugins screen and renamed security plugin folders.

How to clean sites like these

  1. Back up every site on the account as it is.
  2. Delete the fake plugin folders in the file manager or over SFTP, not from the dashboard, since some hide.
  3. Replace infected theme and add-on files with fresh copies from the developers, rather than editing the code out by hand.
  4. Clean the database: the fake plugins’ settings, and scripts added to posts.
  5. Do every site on the account at the same time, then change every password: WordPress administrators, hosting, FTP and database, plus new keys in each wp-config.php.
  6. Scan again after one day and after three days to make sure nothing came back.

Indicators

  • Plugin folders: wordpress-defender, wordpress-security, white-label, related-image
  • Plugin author: “Billy Gin”
  • Domains: interseq[.]at, latoem[.]biz, mlroweb[.]com, renotad[.]com, luqiuid91[.]com
  • Database: options starting with wordpress_defender
  • Other: wlcms_tokens requests; injected code in purify.min.js inside the Astra add-on

Related: unknown admin users in WordPress and WordPress malware that keeps coming back.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

Is “WordPress Defender” a real plugin?
The real plugin is Defender by WPMU DEV, and its folder is called defender-security. A plugin in a folder called wordpress-defender is not it.
Why would malware pretend to be a security plugin?
Because nobody deletes their security plugin. A name like “WordPress Security” makes a site owner, or a developer glancing at the folder, leave it alone.
If several sites share one hosting account, do I have to clean them all?
Yes, at the same time. On most shared hosting, every site on one account can read and change the others’ files. One infected site left alone will reinfect the rest.
How did the attackers get in?
We couldn’t prove the first entry point. On a shared account it only takes one: once a single site is infected, the malware can reach every other site in the account.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →