The Hidden Threat: How Malware Hides in GIF Files on WordPress

When you think of a hacked website, you typically imagine defaced homepages, redirects to spam sites, or locked admin panels. You rarely suspect the innocent-looking images sitting in your media folders.

However, a dangerous and rising trend in WordPress cybersecurity involves hackers hiding malicious backdoors inside files named as images (like .gif or .jpg). If your security scanner recently flagged an “Unknown file in WordPress core” with a name like w-feedebbbbc.gif or xit-3x.gif, do not ignore it.

That “image” is likely a dangerous backdoor. Here is how this attack works, why hackers use it, and how to clean it up.

The Deception: It’s Not Actually a GIF

In a standard scenario, if a hacker tries to upload a malicious .php script to a secured WordPress site, firewalls and built-in filters will often block it immediately. To bypass these defenses, attackers use a technique called Extension Spoofing.

They rename their malicious PHP scripts to .gif. To a human or a basic file filter, image.gif looks harmless. But to the server, a file is just data. If the attacker can trick the server into treating that “image” as a script, the server will execute the code hidden inside.

Anatomy of the Attack

Based on recent malware samples (specifically the “Jue Jiang” or “Open Cache” variants), this attack follows a sophisticated three-step infection process:

1. The “Drop”

The malware creates a file with a deceptive name, such as wp-includes/images/xit-3x.gif. Despite the extension, this file contains obfuscated PHP code—often a Webshell that gives the hacker full control over your files. The code often includes a fake GIF header (like GIF89a) at the very top to trick scanners into thinking it is a valid image preview.

2. The Core Infection

The malware doesn’t stop at creating the fake image. It scans your legitimate WordPress core files to find one that runs on every page load. A common target is:

wp-includes/general-template.php

3. The “Include” Trigger

This is the most dangerous part. The malware injects a tiny, invisible line of code into that core file. It looks something like this:

@include base64_decode("...path to gif...");

This command tells WordPress: “When you load the website template, also load and run whatever code is hiding inside that GIF file.” Because PHP’s include function generally ignores file extensions, the server executes the malicious GIF as code, granting the attacker persistent access to your site.

How to Identify This Infection

How do you know if your “images” are actually malware?

• Security Scans: Tools like Wordfence are excellent at detecting this. Look for warnings that say “Unknown file in WordPress core” located in folders like /wp-includes/images/.

• File Type Mismatch: If you look at the file details in your scanner or file manager, check the Type. If it says “File” or “PHP Script” instead of “Image,” it is malicious.

• Permissions: This specific malware often sets the file permissions to 444 (Read Only). This prevents you from easily deleting the file via the WordPress dashboard.

How to Clean and Fix

If you find a malicious GIF backdoor, follow these steps carefully. Do not simply delete the GIF file first.

1. Check Core Integrity: Because the malware modifies legitimate core files (like general-template.php) to load the GIF, deleting the GIF first might break your site (causing a Fatal Error because the core file is trying to load a missing file).

2. Reinstall WordPress Core: The safest way to remove the infection from core files is to replace them with fresh copies. Go to Dashboard > Updates and click “Re-install Now”. This overwrites the infected PHP files with clean ones from WordPress.org.

3. Delete the Fake Images: Once the core files are clean, you can safely delete the malicious .gif files identified by your scanner.

4. Reset Secrets: Force a logout for all users by changing your salt keys in wp-config.php and reset all administrator passwords.

Summary

Files ending in .gif, .png, or .jpg are not always safe. By disguising PHP code as images and modifying core system files to load them, hackers can maintain long-term access to your website while evading basic detection.

Regular file integrity monitoring and keeping your security plugins active are your best defense against these hidden threats.