Advanced LinkFlow Control Plugin Concealment and Remote Fetching

Summary

This WordPress malware research entry documents fake plugin with conditional fetching evidence observed during one anonymized client investigation. The narrow topic is Advanced LinkFlow Control Plugin Concealment and Remote Fetching: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The combined self-concealment and visitor-context remote request is consistent with conditional content delivery or cloaking. The evidence does not show what the remote endpoint returned in this investigation.

Investigation context

Anonymized investigation with a plugin-directory screenshot and retained source for advanced-linkflow-control.php. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

The named fake-plugin artifact existed in wp-content/plugins.

Confirmed findings

• The all_plugins filter unsets plugin_basename(FILE) unless a request parameter is present.
• The class stores a hex-escaped remote URL.
• The request builder includes current URI, bot flag, language, IP, referrer, host, and user agent.
• The constructor registers loop and fetch-related hooks.

Technical analysis

How the plugin hides from the normal Plugins screen

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

add_filter('all_plugins', function ($plugins) {
    if (isset($_GET['sp'])) return $plugins;
    unset($plugins[plugin_basename(__FILE__)]);
    return $plugins;
});
// remote URL and request details defanged elsewhere

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The combined self-concealment and visitor-context remote request is consistent with conditional content delivery or cloaking. The evidence does not show what the remote endpoint returned in this investigation.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

• Advanced LinkFlow Control
• advanced-linkflow-control.php
• Advanced_LinkFlow_Control
• all_plugins self-unset with sp visibility gate

Contextual indicators

• all_plugins
• plugin_basename()
• wp_remote_get() or cURL
• cache-flush calls

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

• The initial access path and affected software version were not identified.
• No retained response proves the content returned by the remote server.
• The evidence does not establish campaign size, data retention, or a specific visitor outcome.

Artifact-specific remediation

• Preserve the full plugin directory and logs before removal.
• Remove the untrusted directory and compare the plugin inventory with a known-good baseline.
• Search for its class name, directory name, and self-unset filter.
• Review outbound-request logs for the defanged endpoint where available.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

• Confirm the filesystem and Plugins screen remain consistent.
• Monitor for recreation of the directory or class name.
• Review rendered pages for returned content after normal and crawler-like requests.

Related malware research

Browse the WordPress malware research hub.

• system-control Plugin Restored from wp-content/.sc-backup
• WP-Security Fake Plugin with an eval Decode Wrapper
• WordPressCore Fake Plugin with cURL-to-eval Loader Files

Related guides and case studies

• Known fake and malicious WordPress plugins
• Hidden WordPress backdoor investigation

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.