Researchers from Georgia Institute of Technology developed an automated framework called “YODA” to detect malicious WordPress plugins and identify their origins. WordPress is a content management system (CMS) written in PHP that allows webmasters to create and manage a website without needing to program or develop the website itself. The WordPress platform allows the webmaster to install plugins that add features or alter the content programmatically. The plugins are often hosted on a marketplace, where developers can charge for the use of the plugin. While the marketplaces are full of useful plugins, threat actors often upload malicious plugins that trojanize or disguise themselves as popular plugins. This allows the attacker to embed their own malicious code in the webserver to implant webshells, mine cryptocurrency on visitors’ machines, and even steal credentials or skim credit card information. Since WordPress sites are hosted on the internet, they are open to search engines and scans that can detect the malicious plugins. The researchers ran YODA against over 410,000 unique web servers, dating back to 2012. The scan resulted in over 47,337 malicious plugins on 24,931 unique websites, with $834,000 in plugins that were infected post-deployment. The researchers also integrated the application with the CMS, allowing webmasters to download it and scan their own websites for malicious plugins. CTIX analysts recommend individuals and organizations managing WordPress instances install YODA into their own server to prevent the spread of these malicious plugins.