HACKERS ABUSE WORDPRESS MU-PLUGINS TO HIDE MALICIOUS CODE

Summary from the TLDR InfoSec newsletter

Must-Use Plugins (mu-plugins) are special plugins for WordPress sites that automatically execute on every page load and do not appear in the default view on the admin panel. Researchers at Sucuri have observed threat actors abusing mu-plugins for persistence. Sucuri has observed three commonly used payloads: one that redirects users to a malicious browser update site, one that installs a webshell, and one that replaces images with explicit content.