Repeated _0x3023 Obfuscated JavaScript Found Across 17 Files

Summary

This WordPress malware research entry documents repeated obfuscated javascript injection evidence observed during one anonymized client investigation. The narrow topic is Repeated _0x3023 Obfuscated JavaScript Found Across 17 Files: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

Repeated identical obfuscated logic across unrelated assets is consistent with mass injection. It likely relates to the separately documented c-i.icu click script, but direct byte-for-byte provenance is not retained here.

Investigation context

Anonymized investigation with one editor-search screenshot; no complete standalone sample retained in this draft. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

The same obfuscated JavaScript signature occurred in 17 files.

Confirmed findings

• The editor search reports 17 results in 17 files.
• The visible paths span multiple plugin or theme assets.
• The opened code contains _0x3023, _0x365b, localStorage, browser strings, and click-related logic.

Technical analysis

Why the cross-file signature is the primary evidence

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

function _0x3023(a, b) {
  const table = _0x10c8();
  // index adjustment and string lookup shortened
}
// repeated injected body, URLs, and event handler redacted

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

Repeated identical obfuscated logic across unrelated assets is consistent with mass injection. It likely relates to the separately documented c-i.icu click script, but direct byte-for-byte provenance is not retained here.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

• _0x3023 paired with _0x10c8
• 17 results in 17 files
• The same long injected body across unrelated asset paths

Contextual indicators

• Obfuscated variable names
• localStorage
• click
• debug-bar.js

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

• No complete file sample is published for this entry.
• The screenshot does not prove each matched file executed in a visitor browser.
• The initial injection mechanism, destination behavior, and relationship to the separate index.php sample were not confirmed.

Artifact-specific remediation

• Preserve representative files and the search result list.
• Replace affected themes and plugins from trusted distributions rather than editing 17 files individually.
• Search the full account for the decoder pair and adjacent code.
• Investigate how multiple writable components were modified.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

• Repeat the cross-file search after restoration and scheduled tasks.
• Use file integrity monitoring on restored assets.
• Confirm rendered pages no longer serve the injected signature.

Related malware research

Browse the WordPress malware research hub.

• c-i.icu Click-Triggered Redirect Script in index.php
• Hostname-Keyed XOR JavaScript Loader with new Function
• hexagoncontrail-js External Script Injection in WordPress HTML

Related guides and case studies

• JavaScript redirect malware detection guide
• Dangerous JavaScript malware guide

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.