Home/Threat Library/Base64 / eval PHP Malware

Obfuscated PHP

Base64 / eval PHP Malware

Obfuscated PHP code uses base64_decode, eval, gzinflate or similar functions to hide malicious behavior.

Mediumseverity
Obfuscated PHPthreat type
Manualrecommended review

Symptoms

These are common signs associated with this type of WordPress compromise. The exact behavior can vary by hosting setup, cache layer, plugins and how the attacker configured the payload.

  • Security scans report encoded PHP.
  • Files contain unreadable code blocks.
  • Malware is difficult to understand by inspection.

Technical overview

Obfuscation hides remote loaders, backdoors, redirects, spam injectors or command execution from casual review.

Important: visible symptoms are rarely the whole incident. A safe recovery should identify both the payload and the persistence mechanism that allowed it to run.

Indicators of compromise

During investigation, these indicators are commonly reviewed. They do not prove compromise alone, but they help map scope and root cause.

eval(base64_decode())
gzinflate() payloads
str_rot13() obfuscation
Long unreadable PHP strings
Dynamic function execution

Investigation process

WP•FIX treats this as an incident, not a simple file deletion task. The review normally includes WordPress core integrity, theme and plugin files, uploads, database options, users, cron events, redirects, cache layers and the most likely entry point.

Recovery process

  • Create a safe recovery point before changing production data.
  • Remove malicious files, scripts, database payloads and persistence mechanisms.
  • Replace compromised components with clean versions where appropriate.
  • Review administrator users, credentials and access paths.
  • Harden the site and document the recovery path.

Prevention

Prevention depends on the root cause. Common controls include removing nulled components, updating vulnerable plugins, reducing administrator access, hardening login paths, adding monitoring and keeping verified backups.

FAQ

Can this be cleaned with a plugin?

A plugin can help detect common indicators, but serious WordPress incidents need manual review of files, database records, users, access logs, redirects and persistence mechanisms.

Why does this infection come back?

Reinfection usually means the backdoor, vulnerable entry point, compromised credentials or database payload was not removed during the first cleanup.

Can WP•FIX help with this threat?

Yes. WP•FIX can investigate the symptoms, map the scope, remove malicious payloads and recommend hardening steps to reduce reinfection risk.

Need help with Base64 / eval PHP Malware?

If this looks like your site, open an incident and include the symptoms, URL and any warning messages.

Open incident