hexagoncontrail-js External Script Injection in WordPress HTML

Summary

This WordPress malware research entry documents external javascript injection evidence observed during one anonymized client investigation. The narrow topic is hexagoncontrail-js External Script Injection in WordPress HTML: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

Loading untrusted third-party JavaScript gives that resource execution context in the visitor’s browser. The retained evidence does not show whether it redirected visitors, collected data, or loaded another stage.

Investigation context

Anonymized drive-by investigation with a third-party incident notice, rendered source evidence, and a supplied script tag. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

The external script tag was identified during the incident.

Confirmed findings

• The supplied HTML contains a script element with ID hexagoncontrail-js.
• Its src points to simplecopseholding[.]com using a unique path.
• An incident notice independently records the same element and source.

Technical analysis

Why the script ID is the best detection pivot

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

<script
  id="hexagoncontrail-js"
  src="hxxps://simplecopseholding[.]com/[redacted-path]"
></script>

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

Loading untrusted third-party JavaScript gives that resource execution context in the visitor’s browser. The retained evidence does not show whether it redirected visitors, collected data, or loaded another stage.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

• hexagoncontrail-js
• simplecopseholding[.]com
• The script ID and domain appearing together

Contextual indicators

• External script tag
• dns-prefetch resource hint
• Rendered page source

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

• The remote JavaScript response was not retained.
• The repository does not establish how the tag was injected.
• The separate obfuscated PHP sample was supplied in the same draft, but a direct operational relationship was not confirmed.
• The excluded screenshots contained identifiable client and contact information.

Artifact-specific remediation

• Preserve the rendered source and relevant database/file evidence.
• Remove the injection from its confirmed storage location once found.
• Search files and database records for the script ID and defanged domain.
• Review access and change history to identify the write path if logs permit.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

• Recheck rendered HTML for the script ID from clean browser sessions.
• Search the database and filesystem after scheduled tasks run.
• Confirm the external resource hint and script element do not return.

Related malware research

Browse the WordPress malware research hub.

• c-i.icu Click-Triggered Redirect Script in index.php
• wpinfo-pst1 Obfuscated Redirect Stored in post_content
• Database-Stored fetch() Calls Injecting Remote Spam Content

Related guides and case studies

• simplecopseholding.com malware removal guide
• JavaScript redirect malware detection guide
• Drive-by domain-deactivation case study

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.