thamario
Forum Replies Created
-
Update: Resolved via clean rebuild
Following up on this thread. My hosting provider’s “Fix Permissions” tool was able to remove the immutable flag (chattr +i) from the two files I couldn’t delete. Once that worked, I proceeded with a full clean rebuild:
- Deleted the entire database and public_html
- Fresh WordPress core from wordpress.org
- Imported the database from a backup taken August 19 (before infection)
- Reinstalled all plugins fresh from official sources
- Rotated all passwords and salts again
The site has been live for a full day now with no signs of reinfection — no craft-system-orb files, no sc_ options, no unauthorized admin accounts. Monitoring closely over the next few days, but marking this as resolved.
Final update: found the underlying research
For anyone finding this thread later — this matches a campaign documented by Monarx Security (Aug 17, 2026):
https://www.monarx.com/press-news/the-wordpress-infection-that-rebuilds-itself-faster-than-you-can-delete-itKey detail most guides miss: this family also plants a malicious Service Worker scoped to /wp-admin/ and /wp-login.php in every admin’s browser. Server-side cleanup alone doesn’t stop it — every admin who logged in during the infection needs to manually unregister the Service Worker (DevTools → Application → Service Workers) on every device.
Forum: Fixing WordPress
In reply to: Site reinfected after complete cleanup and credential rotationUpdate: Resolved
Following up, my host’s file permission repair tool removed the immutable attribute that was blocking deletion of the malicious files. After that, I did a full clean rebuild: fresh WordPress core, database restored from a pre-infection backup, plugins reinstalled from official sources, all credentials rotated.
Site has been stable for a full day with no reinfection. Closing this out as resolved, thanks for the input.
Final update: found the underlying research
For anyone finding this thread later — this matches a campaign documented by Monarx Security (Aug 17, 2026):
https://www.monarx.com/press-news/the-wordpress-infection-that-rebuilds-itself-faster-than-you-can-delete-itKey detail most guides miss: this family also plants a malicious Service Worker scoped to /wp-admin/ and /wp-login.php in every admin’s browser. Server-side cleanup alone doesn’t stop it — every admin who logged in during the infection needs to manually unregister the Service Worker (DevTools → Application → Service Workers) on every device.