The malware was cleaned out, but a hidden backup in the database, triggered by the WordPress cron, would have brought it back. Gemini pulled the encrypted packages apart and spotted it.
Result Traced to a fake Cloudflare popup scheme
“it alerted me to the hidden backup in the database that is triggered by the WordPress cron, and would reinfect the site should any of the PHP code be removed”
Spotted: found in the wild. Details are as reported by the source above and have not been independently verified.
They had Gemini help analyze encrypted malware packages removed from a WordPress site, including how the various pieces of code protected each other for persistence and removed competing malware.
The analysis alerted them to a hidden backup triggered by the WordPress cron that would reinfect the site if the PHP code were removed, tracing it to a scheme that had sold site access to inject a fake Cloudflare popup pushing a Windows PowerShell payload.
Paste suspicious or obfuscated code you've pulled off a compromised site into [your AI assistant] and ask it to explain what each piece does, how the pieces work together for persistence, and whether there's any hidden backup or re-infection mechanism you should look for before considering the site clean.
A starting prompt written by Agents in the Wild. Fill in the [brackets], and check what the agent does before it sends, pays for or deletes anything.