Critical Mobile Redirect Malware Injection via td-mobile-plugin

Hello tagDiv Team and Community,

I wanted to report a severe, obfuscated malware infection targeting the Newspaper theme ecosystem that I recently diagnosed and cleaned. The malware specifically targets mobile users while executing stealth tactics to hide from logged-in administrators.

Here are the technical details of the exploit to help the security team and other users:

1. The Behavior:
Mobile visitors loading the site are immediately hit with a 302 Redirect chain. The network analysis showed the site calling a rogue script masquerading as an ad network: [https://async.gsyndication.com/](https://async.gsyndication.com/). This script then loads a Yandex tracking tag ([https://mc.yandex.ru/metrika/tag.js](https://mc.yandex.ru/metrika/tag.js)), which triggers the final destination spam redirect (e.g., varors.com).

2. The Entry Point / Core Infection:
The script dynamically prepends an obfuscated PHP code block to the very top of wp-config.php using an eval(base64_decode(…)) string. When decoded, the script explicitly avoids injecting the malicious payload if the request URI contains paths like /wp-admin/, /wp-json, or wp-login.php, effectively hiding the redirect from site admins.

3. The Active Backdoor Location:
After cleaning wp-config.php, the file was repeatedly re-infected. Running a server-side file modification search (find . -mtime -2 -type f) isolated the live backdoor execution directly inside the td-mobile-plugin directory.

Files inside wp-content/plugins/td-mobile-plugin/ (specifically Mobile_Detect.php and custom code panel handlers) had been compromised and modified by the attacker to act as a persistent script injector. Every time a mobile user-agent touched the site, the plugin dynamically rewrote wp-config.php to maintain persistence.

How it was resolved:

Completely deleted the compromised td-mobile-plugin directory from the server.

Cleaned the wp-config.php file and stripped the eval block.

Implemented define( ‘DISALLOW_FILE_MODS’, true ); and hardened server file permissions (chmod 440 on config).

Please look into how the automated bots are injecting code into the td-mobile-plugin directories, and let this serve as a warning to other webmasters to check their mobile plugin files if they experience ghost redirects!