How Zoho Mail’s outgoing filters acted as a tripwire

The Incident

On March 9, 2026, an automated botnet, a WordPress Malware exploited a known vulnerability in WordPress plugins on hypesrilanka.com.

Our analysis showed that the malicious /metasync/ and /wph/ directories appeared in the file system with timestamps nearly identical to the last modification of the 3D Viewer for Elementor directory on March 9, 2026.

OTTO is the AI assistant feature inside Search Atlas SEO, a legitimate SEO platform. Their WordPress plugin uses metasync as its slug. The attacker almost certainly chose the /plugins/metasync/ directory name deliberately because it already existed on the site.

The attacker successfully uploaded a backdoor suite, designed to scrape sensitive database credentials and WordPress Salts. They dropped malicious files inside the legitimate Search Atlas plugin directory, hiding backdoor PHP files among the real plugin files. The plugin kept working so nothing looked obviously wrong.

In many File Upload exploits, attackers use a niche plugin’s media-handling folder as a staging area because these directories often have broader write permissions.

While major CVE lists like CVE-2026-3132 highlight Master Addons, niche or premium plugins like 3D Viewer often have undocumented vulnerabilities or Zero-Days that haven’t been indexed by public databases yet.

The Loophole

The malware was programmed to phone home by emailing these credentials to a remote Command & Control (C2) address. However, it made a fatal error: it used the server’s local mailer without proper SMTP authentication.

Early 2026 saw a massive wave of Remote Code Execution (RCE) bugs in Elementor Addons, such as Master Addons for Elementor (CVE-2026-3132).

If any of these addons were present on the site, even if recently deleted, they could have provided the initial God Mode access.

The breach wasn’t just files; it was a full identity theft. A rogue user named “Cristine” was created, linked to the exfiltration email [email protected].

We found three distinct “burner” domains used for exfiltration: mailbox10.info, ukmailbox.xyz, and hasimu.genuine.mom.

The specific error code Status: 421 – Host not reachable is the proof that Zoho Mail’s outgoing filters successfully blocked the data from reaching the hacker’s server.

The Zoho Hero Moment

Our email provider, Zoho Mail, identified the outgoing message as unauthorized and structurally suspicious (containing plaintext salts/passwords).

The Block – ZohoMail’s Reputation Filter refused to deliver the email to the attacker.

The Alert – Because the email failed, Zoho sent a Bounce Message back to the administrator account.

The Reveal – This Bounce contained the full transcript of the malware’s attempt, providing the exact file paths (/uploads/metasync/) needed to begin the cleanup.

The Exfiltration Mistake – How we found it

Most infections remain dormant for months. This breach was identified within 24 hours due to a critical error in the malware’s exfiltration logic.

The Trigger – The malware attempted to phone home by emailing stolen database credentials and site salts to a Command & Control (C2) address.

The Fail-Safe – Because the attacker used a malformed or invalid recipient address, the server’s SMTP provider (Zoho Mail) rejected the delivery.

The Forensic Trail – Zoho Mail issued a DSN (Delivery Status Notification) Bounce Message back to the site administrator. This Self-Snitching mechanism provided the exact timestamps and file paths used in the breach.

Key Takeaway – Monitor your “Bounce Messages.” If your server is sending mail you didn’t authorize, it is likely exfiltrating your data.

The Trojan Mimic & Client-Side Theft

We discovered that the initial purge was insufficient. The malware had a Plan B that exploited our own brand trust.

The Trojan Mimicry

The malware created a file named wp-system-core.php inside the mu-plugins folder. It was disguised as the HypeX Console Signature, a plugin we use for internal branding. It even contained our legitimate signature code but hid a massive Base64-encoded payload.

The Persistence Architecture – How it Stayed Alive

The Malware suite was designed for Redundancy.

Vulnerabilities like CVE-2026-1004 (Sensitive Information Exposure) could have allowed the attacker to read the wp-config.php file directly, explaining why they were able to inject duplicate salts so effectively.

Deleting the files was not enough to stop the infection because of three Ghost layers,

A. The wflogs Misdirection

The attacker didn’t just bypass Wordfence; they hijacked it. By modifying /wp-content/wflogs/config-synced.php, the attacker whitelisted their own IP. To the Firewall, the attacker appeared as a Trusted Admin.

B. The Zombie Cron Hooks

The malware registered high-frequency tasks in the WordPress Cron system disguised as legitimate plugin hooks:

• mm_cron_twicedaily (Disguised as MemberMouse)
• wpil_telemetry_cleanup (Disguised as Link Whisper)
• wph_environment (Disguised as “WP Hardening”)

Every 12 hours, these tasks checked if the malicious files had been deleted. If missing, the script would re-download them from a remote server.

C. The Database Data Locker (Data Sanitizing)

The malware used Orphaned Database Tables. Even though BuddyPress and bbPress were not installed, the wp_bp_ and wp_bb_ tables were present and used to store malicious configuration strings.

We discovered a cloaking mechanism. A secondary .htaccess was hidden inside the mu-plugins folder, specifically designed to hide the Trojan from Wordfence scans.

Furthermore, “Disabled” plugin folders we had in subdomains acted as permanent bridges, hosting obfuscated chr() scripts to re-infect the main site.

The Client-Side Bypass

This was the most critical finding. Despite disabling the PHP mail() function, the data leak continued.

The Revelation – The malware wasn’t using the server to send data. It injected malicious JavaScript into the visitor’s browser.

The Execution – When a user submitted a contact form, the browser itself stole the data and sent it to .xyz and .mom domains.

The Counter-Measure – We implemented a Content Security Policy (CSP) via .htaccess headers to force the browser to block any unauthorized outbound connections.

So What did we do? The Zero-Trust Recovery Protocol

We have implemented a Zero-Trust environment.

We moved beyond just locking the doors (Ingress) and started controlling who the server is allowed to talk to (Egress).

The recovery followed a Manual Forensic Purge rather than a simple plugin scan. Honestly, Wordfence was blind and crippled struggling to complete a single scan.

We bypassed the PHP layer (which was compromised) and used the Linux Shell to identify and destroy the payloads.

We ran the following in the cPanel Terminal.

# Find and delete all PHP shells in the uploads directory

find ./public_html/wp-content/uploads -name "*.php" -type f -delete

# Identify the WPH and backdoor directories in MetaSync folder

rm -rf ./public_html/wp-content/plugins/wph

rm -rf ./public_html/wp-content/plugins/metasync

Then we transitioned the site from “Writeable” (Standard) to “Read-Only” (Hardened).

uploads/.htaccess Permission to 444: Specifically blocks PHP execution in the media folder.

wp-config.php Permission to 440: Prevents any script from ever injecting salts or changing DB credentials again.

.htaccess Permission to 444: Makes server-level rules immutable.

Because the malware successfully exfiltrated Salt and Database Password data, the old “Keys” were compromised.

Reset Salts – Invalidated all active cookies globally.

MySQL Password Change i Changed the database user password in cPanel to kill any remote SQL connections.

Why Egress Filtering is a Major advantage

Most malware, including the this malware, RAT, relies on Calling Home to a hacker’s server to send stolen data.

By setting up an Invisible Fence, we tell WordPress, “You are only allowed to talk to my trusted friends (Google, Zoho, Elementor). If anyone else tries to call you, hang up immediately”.

Then we added a specific “Sandboxing” code to the site’s DNA (wp-config.php). This code blocks all unknown outbound web requests.

Finally, to make this defense absolute, we went into the cPanel (Select PHP Version) and disabled the tools hackers use to bypass normal security. We added these functions to the disable_functions list. The trade-off here is every time we use a new plugin we need to update the wp-config file to ensure the plugin works.

How to Avoid This in Future?

You can tighten and harden the website to the point it can be really difficult for you to get in with access but there will always be another way in. Ensuring that we pick it up in time is important.

Why it’s important to follow a Professional Update Protocol

For a high-stakes website, you should never leave the site open (644 permissions) just for the sake of convenience.

You must use a Maintenance Window strategy instead of just keeping everything open.

How to handle WordPress updates

Here is how we do it at HypeX.

We Open the Gates (Temporary)

We run these commands in our GreenGeeks cPanel Terminal (one line each) to allow WordPress to write the new version.

chmod 644 public_html/wp-config.php
chmod 644 public_html/.htaccess
find public_html/wp-admin public_html/wp-includes -type f -exec chmod 644 {} +

Then we go to WordPress Dashboard and updated the plugins, themes and WordPress itself.

Relock the Fortress (Crucial)

Once the update is successful, we re-apply the hardening, or the Malware bot in the MetaSync folder or its brothers will have an opening again. Lol. Run these one by one in the terminal.

chmod 440 public_html/wp-config.php
chmod 444 public_html/.htaccess
# Ensure the uploads folder remains locked for PHP
chmod 444 public_html/wp-content/uploads/.htaccess

The HypeX Verdict

Security is not a plugin; it is an Attack Surface Reduction.

Lot of web designers and developers in Sri Lanka use WordPress and often they just activate a plugin like Wordfence or Securi and say the website is safe.

In this scenario with hardening there was a way in using a plugin vulnerability.

There are always Zero-day exploits.

By deleting the 3D Viewer plugin, dropping the BuddyPress and SearchAtlas debris, and setting Immutable Permissions, we didn’t just clean the site, we made it an inhospitable environment for malware.

We combined Authenticated ZohoMail SMTP with Egress Filtering, so now we are in a Zero-Trust state.

If you think your business website needs to be secure and you don’t have the time to do these mentioned in this article, reach out to us.

Try out Malware Sentry to keep your website secure.