Cookie-Indexed PHP Loader in an .htaccess-Named File

Artifact class Cookie-indexed PHP loader

Evidence confidence High

Risk assessment High

Start with the problem you are seeing

Could this match the problem on your WordPress site?

This entry helps owners and responders assess an unusually small PHP file named like .htaccess inside a plugin directory. The artifact selected cookie data and passed it to an include operation, but no visible front-end symptom was retained.

Observed in this investigation

A 308-byte PHP program was retained from an .htaccess-named file inside a WordPress plugin directory.

Possible warning signs

The website may show no obvious visible change while the file remains present.
A malware scanner or file review may report unexpected PHP code in a file normally used for server directives.

These signs are investigation leads, not proof of this artifact by themselves.

Questions this research can help answer

Why is there PHP code inside an .htaccess file?
Can a WordPress backdoor exist without changing the visible website?

Evidence boundary: The supplied artifact shows a loader structure; it does not establish what input was supplied or whether it executed.

Seeing one of these signs on your site?

I can investigate the files, database records, users, and server evidence, explain what is confirmed, and help plan a safe cleanup.

Ask me to investigate your site See how my malware cleanup works

Research focus: Forensic review of a 308-byte PHP loader that assembled callable names from cookie values and included a generated temporary path.

Summary

This WordPress malware research entry documents cookie-indexed php loader evidence observed during one anonymized client investigation. The narrow topic is Cookie-Indexed PHP Loader Found in an .htaccess-Named File: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The code is consistent with a request-gated loader that expects a specially structured cookie set. Whether the server configuration executed PHP from this filename is not shown.

Investigation context

Anonymized investigation with one privacy-reviewed file-viewer screenshot and the retained 308-byte PHP sample. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

A 308-byte PHP loader existed at the observed plugin path.

File viewer showing 308 bytes of PHP in wp-rootkit-tract slash .htaccess — The file viewer shows compact PHP inside an .htaccess-named file under wp-rootkit-tract. The account portion of the path was already irreversibly redacted.

Confirmed findings

The file viewer identifies wp-content/plugins/wp-rootkit-tract/.htaccess and a size of 308 bytes.
The code reads $_COOKIE and reconstructs values by numeric indexes.
The final operation includes a generated path.

Technical analysis

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

$c = $_COOKIE;
// numeric indexes assemble callable names and a temporary path
$generated = $parts[0]() . $parts[25];
include $generated; // payload construction redacted

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The code is consistent with a request-gated loader that expects a specially structured cookie set. Whether the server configuration executed PHP from this filename is not shown.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

wp-rootkit-tract/.htaccess
$c[36][$n]
include($generated) after cookie-derived callable assembly

Contextual indicators

$_COOKIE
include()
.htaccess
plugin directory

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

The screenshot does not establish that the .htaccess-named file executed as PHP.
No triggering request or cookie values were retained.
The decoded payload and initial compromise method were not established.

Artifact-specific remediation

Preserve the 308-byte file and relevant request logs.
Remove the untrusted wp-rootkit-tract directory after verifying it is not legitimate.
Search for the same numeric-index loop and related copies.
Review server handlers to determine whether PHP could execute from the observed filename.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

Confirm the directory and file do not return.
Review access logs for unusual cookie-heavy requests where retained.
Monitor the plugin directory for unexpected dotfiles.

Browse the WordPress malware research hub.

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.

Cookie-Indexed PHP Loader Found in an .htaccess-Named File