WordPress Site Was Hacked & Re-Infecting Itself Every 30 Seconds — I Found It and Fixed It

A B2B media site was under a persistent automated malware attack — re-infecting itself every 5–30 seconds, 26 days straight.

What I did: → Built a custom batch malware scanner (zero timeout) → Located hidden C2 shell in orphaned plugin folder → Hex-decoded the obfuscated PHP shell → Confirmed remote Command & Control architecture → Permanently ended 16,930 re-infection attempts

Result: 0 new infections. Site fully operational.