Hidden Systemd Binaries Expose Rootkits Reinjecting WordPress Mobile Redirects Every 5 Minutes
Analysis reveals a mobile-redirect rootkit that blinds standard WordPress security plugins by anchoring its persistence in the OS and memory caching layers.
The attack exploits wp-config.php, injecting a Base64-encoded payload via eval(base64_decode(...)).
The script parses the User-Agent string to execute a cloaking loop, redirecting only mobile traffic to spam networks while serving clean pages to desktop browsers.
To maintain invisibility, the payload drops API, CLI, and known administrator requests.
File-level remediation fails because the architecture relies on a malicious systemd service named defunct.service.
Masquerading as the legitimate D-Bus connection bus, the service triggers a hidden ELF binary at /usr/bin/defunct.
This executable disguises itself in process logs as a fake kernel thread named [raid5wq] and automatically reinjects a fake Akamai script (ak.akam60800.net) into the configuration files every 5 minutes.
A secondary persistence vector hijacks the OpenLiteSpeed server cache.
When the rootkit runs, it force-injects the script dynamically, prompting the server to cache the fully rendered malicious page inside /usr/local/lsws/cachedata/__.
Even after administrators delete the corrupted PHP files and kill the rootkit binary, OpenLiteSpeed safely serves the poisoned page directly from its internal memory.
Completely collapsing the infection requires flushing this cache directory, stripping immutable flags from hidden SSH authorized keys, and deleting auto-loading 01-mu-__.php files.