Skip to content
MP MD Pabel WordPress security

WordPress Malware Research Entry

Hostname-Keyed XOR JavaScript Loader with new Function

Found heavily obfuscated JavaScript that changes behavior by hostname? This evidence review explains what is visible and why theft is not proven.

Reviewed: July 22, 2026
Artifact class Hostname-keyed JavaScript loader
Evidence confidence High
Risk assessment High

Start with the problem you are seeing

Could this match the problem on your WordPress site?

This entry is relevant when a checkout or site audit uncovers hostname-dependent, obfuscated JavaScript. The code structure warrants investigation, but the supplied fragment does not show collection or transmission of payment-card data.

Observed in this investigation

  • The supplied JavaScript used obfuscated strings and hostname-dependent branching.

Possible warning signs

  • The script may behave differently across domains or environments.
  • The page can appear normal while the obfuscated branch remains difficult to review.

These signs are investigation leads, not proof of this artifact by themselves.

Questions this research can help answer

  • Why does this obfuscated JavaScript check my website hostname?
  • Does suspicious checkout JavaScript prove that card details were stolen?

Evidence boundary: The evidence does not establish card-data collection, exfiltration, or a completed checkout skimmer workflow.

Seeing one of these signs on your site?

I can investigate the files, database records, users, and server evidence, explain what is confirmed, and help plan a safe cleanup.

Ask me to investigate your site See how my malware cleanup works

Research focus: Forensic analysis of JavaScript that reversed and XOR-decoded a hex-escaped blob with window.location.hostname before using new Function.

Summary

This WordPress malware research entry documents hostname-keyed javascript loader evidence observed during one anonymized client investigation. The narrow topic is Hostname-Keyed XOR JavaScript Loader with new Function: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The hostname key can make the decoded body site-specific and hinder casual analysis. The legacy credit-card-stealer label exceeded the evidence because no form selectors, payment fields, network destination, or captured data were retained.

Investigation context

Anonymized investigation with a supplied JavaScript wrapper and no retained screenshot. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

The public entry does not use a screenshot because the retained images either exposed sensitive values, showed a complete encoded payload, or did not add reliable evidence beyond the supplied code.

Confirmed findings

  • The embedded blob is represented with hexadecimal escape sequences.
  • The wrapper reverses the blob before XOR transformation.
  • window.location.hostname supplies the repeating XOR key.
  • The result is provided to new Function and invoked.

Technical analysis

How the hostname becomes the decode key

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

const reversed = embedded.split("").reverse().join("");
const decoded = xorCharacters(reversed, window.location.hostname);
new Function(decoded)();
// embedded blob and helper implementation redacted

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The hostname key can make the decoded body site-specific and hinder casual analysis. The legacy credit-card-stealer label exceeded the evidence because no form selectors, payment fields, network destination, or captured data were retained.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

  • window.location.hostname used as an XOR key
  • Reversal followed by XOR decoding and new Function
  • Hex-escaped embedded JavaScript blob

Contextual indicators

  • new Function()
  • window.location.hostname
  • XOR loop
  • Obfuscated JavaScript

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

  • The decoded body is not published or characterized.
  • No checkout page, payment field, exfiltration request, or affected commerce component was confirmed.
  • The deployed storage location and initial compromise method were not identified.

Artifact-specific remediation

  • Preserve the original script privately.
  • Locate and remove the confirmed storage record or modified file.
  • Search rendered HTML, files, and database content for the wrapper shape.
  • Review browser and server logs for related external requests if retained.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

  • Recheck rendered pages across the relevant hostnames.
  • Use file and database integrity checks for the wrapper.
  • Confirm no new dynamic-function loaders appear after checkout or login flows.

Browse the WordPress malware research hub.

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.