TA2726 turns 1,509 WordPress sites into malware launchpads

TA2726 turns legitimate WordPress pages into malware delivery infrastructure. A visitor lands on a trusted site, the page runs a three-step eligibility check, and selected Windows users are handed to TA569's SocGholish fake browser update. The lure downloads Google Launcher.js; running it starts GhoLoader, which posts to its controller and executes the next stage on the visitor's Windows system.

Proofpoint documented this downstream SocGholish and GhoLoader sequence in June 2026, along with its history of follow-on ransomware activity (opens in new tab). The WordPress layer examined here exposes the traffic gateway that decides who reaches it.

Between April 21 and July 21, 2026, we observed the exact platformist-quadendpointer-sxadtr/v1/s6qgn implant on 1,509 WordPress hosts. Every route match in that window belonged to the malicious framework.

On shared hosts in our dataset, the TA2726 gateway appeared before later ClickFix injections. That later layer uses Polygon EtherHiding to resolve its next stage.

---

Campaign at a glance

---

TA2726 sits between the hacked site and the malware operator

Proofpoint introduced the TA2726 and TA2727 names on February 18, 2025 (opens in new tab) after separating traffic distribution from activity previously grouped under SocGholish. Its retrospective analysis traces TA2726 activity to at least September 2022.

The chain has four distinct roles:

The s6qgn route identifies the TA2726 delivery layer. The content returned after visitor selection identifies the malware path.

---

The full malware path

The Windows branch follows this sequence:

compromised WordPress page
  -> injected fake-plugin JavaScript
  -> wp-admin/admin-ajax.php state bootstrap
  -> same-origin REST, query-string, or PHP gateway
  -> opaque state transitions
  -> controller-supplied JavaScript filters
  -> controller decision
       -> terminal response
       -> backend error
       -> external loader
            -> TA569 SocGholish fake browser update
            -> Google Launcher.js
            -> GhoLoader
            -> follow-on code execution

The early requests stay on the legitimate hostname. WordPress relays the browser state to an upstream controller and returns the decision as JavaScript. The visitor sees requests to the trusted site while the controller sits behind the compromised server.

The site's criminal lifecycle continues with ClickFix:

TA2726-infected WordPress site
  -> later ClickFix injection
  -> Polygon eth_call
  -> smart-contract response
  -> next-stage script injection
  -> ClickFix social engineering and malware delivery

The TA2726 gateway and the ClickFix injection share the WordPress host. Each layer carries its own code and indicators.

---

WordPress issues the first state token

A representative injected configuration contains four values:

gateway:      https://<site>/wp-json/platformist-quadendpointer-sxadtr/v1/s6qgn
campaign ID:  T6cSdwTEXsJcDYRlaQf-Iw
AJAX URL:     https://<site>/wp-admin/admin-ajax.php
AJAX action:  multiapping_fastapiity

When the page loads, the injected script posts the generated action to WordPress:

POST /wp-admin/admin-ajax.php
Content-Type: multipart/form-data

action=multiapping_fastapiity

WordPress returns a generated field containing an opaque client token. The browser posts that token to the local s6qgn route.

Simplified behavior:

onPageLoad:
    state = POST admin-ajax.php with generated action
    response = POST [state, false] to same-origin gateway
    execute response as JavaScript

The route response enters a new script element and runs with the trusted site's origin. The injected code gains the same page-level access as other JavaScript loaded by that site.

admin-ajax.php becomes a strong signal through the full sequence: generated action, opaque token, immediate gateway request, and execution of the returned body.

---

The `s6qgn` gateway uses a three-step state machine

A complete controller exchange uses three requests:

1. POST [CID_A, false]
   -> JavaScript containing CID_B

2. POST [CID_B, false]
   -> JavaScript containing filters and CID_C

3. POST [CID_C, true, {filter results}]
   -> final controller decision

Each response removes the previous injected script before adding the next one. The controller advances the browser through issued state, with every response carrying the next step.

The middle response contains a filter engine. It base64-decodes JavaScript templates, executes them through indirect eval, waits for Promises, converts each result to a boolean, and sends those results back to the gateway.

Two templates in this branch were simple test expressions:

(console.log('t'), true)
(console.log('f'), false)

The engine accepts synchronous and asynchronous JavaScript. Its boolean output gives the controller a programmable visitor gate for operating system, browser state, prior exposure, interaction, geography, reputation, and campaign timing.

Two token formats carry controller state

Related modules use two stable layouts:

Both formats begin with a 16-byte binary prefix and preserve stable lengths across transactions. Those fixed lengths remain useful protocol indicators when route names and token values rotate.

The first REST request includes a WordPress nonce. Continuation requests use the returned state token. Query-string and direct-PHP siblings carry the same state model through different transports.

---

Every response class identifies the implant

Across 262 requests to the s6qgn route, the gateway returned this distribution:

Two recurring bodies expose the server-side handler:

HTTP 403
{"code":"rest_cookie_invalid_nonce","message":"Cookie check failed",...}

HTTP 500
/* Backend request failed */

The HTTP 500 body records an upstream relay failure. The WordPress route remains present and active even when the controller fails.

Detection should match every status class. A route match covers successful delivery, expired state, visitor rejection, controller errors, and backend outages.

---

One framework carries many generated names

The s6qgn route sits beside modules that share generated naming, token framing, retry logic, filter execution, and response grammar.

Recurring components include:

platformist-quadendpointer-sxadtr/v1/s6qgn
framework-triappment-xk30rc/v1/s36f8
legacy-macrotrace-a932433ae428/v1/4c53efaff7d2
ultraapiist-pentajavascripter-8oyop7/v1/slk5x
uniserviceist-multiinfrastructure/miniclouder-smartserverless.php
morris_virtual through a vvWr query gateway
short query gateways such as qwcobq=uxpq
site-specific REST namespaces

Newer routes follow this shape:

/wp-json/<word-salad>-<12 hex>/v1/<12 hex>

Examples include:

/wp-json/polytransit-macromuxer-c2d72c3a5086/v1/fb33a08c6693
/wp-json/python-datapath-a0d7c2a33ffe/v1/05a07e951e17
/wp-json/macrosketch-interface-e986cc57ae47/v1/edd0de4a1aa3

One infected WordPress site loaded six related modules in a few seconds. Four completed token, filter, and decision sequences. Two returned repeated backend errors. Every malicious request stayed on the compromised origin.

The visible lineage spans seven months:

December 2025: uniserviceist plugin asset and PHP gateway
March 2026:    morris/vvWr query gateway
April 2026:    stable s6qgn REST route
May-July 2026: short query gateways and generated parallel REST modules

The names rotate while the responsibilities remain stable:

1. Establish state through an embedded token or AJAX bootstrap.
2. Send state to a gateway on the compromised site.
3. Execute JavaScript returned by that gateway.
4. Evaluate controller-supplied filters.
5. Continue, store a cooldown marker, end the session, or load a malware stage.

---

The external loader waits for a real person

One successful s6qgn decision returned JavaScript that:

1. Defined window.abcCallback1221.
2. Sent a status beacon to api[.]pimparolix[.]com.
3. Loaded an obfuscated script from api-ext[.]bixbitemarketing[.]com.

api[.]pimparolix[.]com handles status and decision telemetry. api-ext[.]bixbitemarketing[.]com serves the executable browser loader.

The 64,609-byte loader uses a rotating string array and an RC4 decoder. Its interaction gate follows this path:

1. Send an encrypted-path beacon.
2. Register mousemove and pagehide handlers.
3. Wait for human interaction.
4. Remove the mouse listener on the eleventh movement.
5. Load the next script from another encrypted path.
6. Send an abandonment or decision beacon when the page closes first.

The loader checks three browser signals:

navigator.webdriver === true
WordPress administrator cookies
large differences between outer and inner window dimensions

The window-dimension check targets open developer tools. Automation, administrator state, and developer tools lead to alternate controller decisions. Eligible visitors continue to the malware path.

---

TA569 delivers SocGholish and GhoLoader

Proofpoint's June 2026 analysis (opens in new tab) documents the matching TA569 branch under:

platform[.]exathomeswebuyarizona[.]com

SocGholish profiles the visitor, checks automation and developer-tool signals, evaluates previous exposure and WordPress administrator state, and waits for repeated mouse movement. An eligible visitor sees the legitimate page replaced by a fake browser update.

The download button sends postMessage to a hidden data: iframe. The iframe retrieves embedded JavaScript, converts it into a blob: URL, and triggers a download named Google Launcher.js.

Proofpoint identifies the GhoLoader Stage 1 controller as:

js-new[.]newtoyourgame[.]com

GhoLoader is Windows Script Host JScript. It uses MSXML2.XMLHTTP to post to its controller and executes the returned JavaScript. This turns a visit to a legitimate WordPress page into code execution on the visitor's Windows system.

Our analysis covers the WordPress gateway, visitor filtering, external loader, and SocGholish handoff. Proofpoint's reporting supplies the GhoLoader behavior that follows the fake update.

---

ClickFix appears later on TA2726-infected sites

On the shared hosts we observed, TA2726 infection came first and ClickFix appeared later.

On one s6qgn-infected site, the page also carried four ClickFix script blocks labeled:

X-Secure Web Metrics 1.6.5
X-Secure Data Flow 1.0.8
X Elite Web Metrics 3.4.9
X-Dynamic Web Metrics 2.0.6

Each block decoded a base64 string, XORed the bytes with a one-byte key, converted the result to text, and executed it with new Function.

The four decoded programs performed the same work:

1. Query a public Polygon RPC endpoint with eth_call.
2. Read an ABI-encoded string from a smart contract.
3. Append a site identifier and minute-based cache value.
4. Inject the resulting URL as a script.

The ClickFix tuple is:

Contract: 0xfD75a8F503be4851E11a52b645De1f017492A6b0
Selector: 0xb68d1809
Method: eth_call
Site ID: ffa65e22169204ca1ac7588970f688d7401d3ffe20656099
Stage: <contract-returned-base>/api.php?s=<site-id>&_v=<unix-minute>

Guardio introduced the EtherHiding name in 2023 (opens in new tab) for malicious web stages that retrieve code or infrastructure from smart contracts. Derp has also documented a ClickFix chain that uses EtherHiding to resolve later malware infrastructure.

The contract and selector identify the ClickFix layer on a WordPress host already infected with TA2726. The s6qgn route identifies the earlier gateway. The pairing shows one host moving through two malware-delivery systems.

Public Polygon RPC services provide transport. Detection should anchor on the contract, selector, eth_call, ABI decoding, and script injection sequence.

---

Operation Endgame hit SocGholish while the WordPress gateway remained active

On June 18, 2026, law enforcement announced an Operation Endgame action against SocGholish. The Dutch National Police reported 106 servers and domains disrupted and 14,971 infected websites remediated (opens in new tab).

Proofpoint placed the primary operational impact on TA569 (opens in new tab) and described TA2726 as a traffic provider shared by multiple malware operators.

The exact s6qgn route remained active through the July 21 reporting cutoff. Operation Endgame struck the SocGholish payload layer while the TA2726 WordPress gateway continued routing visitors.

---

Detection starts with the WordPress gateway

The highest-confidence network indicator is the full route:

/wp-json/platformist-quadendpointer-sxadtr/v1/s6qgn

WordPress query routing produces this alternate form:

/index.php?rest_route=/platformist-quadendpointer-sxadtr/v1/s6qgn

Correlated behaviors include:

injected generated JavaScript in the page
POST of a generated action to /wp-admin/admin-ajax.php
JSON array containing an opaque token and a continuation boolean
rapid repeated POSTs to a generated same-origin gateway
X-WP-Nonce on the first REST request
response text inserted into a new script element
second request carrying filter results
PH_PARAM_DIAG=1 sent to the malicious route

Strong content anchors include:

platformist-quadendpointer-sxadtr
s6qgn
multiapping_fastapiity
T6cSdwTEXsJcDYRlaQf-Iw
PH_FUNC_DO_REQUEST
PH_VAR_FILTER_DATA
continueWithGatewayRequest
trivueable_autoreactment
pentaapplicationist_quickinfrastructureal
eval(atob(filter.template))

Cookies across complete related chains include:

wpgq_tds_fail
T6cSdwTEXsJcDYRlaQf-Iw_<generated suffix>
TKEy1GF_N3zKKshz-YDslA_<generated suffix>

Route-level detection should cover HTTP 200, 401, 403, 404, 405, 500, and 502 responses, along with transactions where response status is missing. Response hashes, MIME types, downstream domains, SocGholish content, and payload downloads add context after the route match.

For the later ClickFix layer, correlate the route with this behavior:

Polygon JSON-RPC eth_call
ABI dynamic-string decoding
script injection from the contract-returned base URL

---

Host-side evidence and cleanup

A public WordPress cleanup report from May 2026 (opens in new tab) documented a server-side counterpart under:

/wp-content/plugins/platformist-quadendpointer/

The main file was:

platformist-quadendpointer.php

Its fake plugin header used:

Plugin Name: ultravueal reactsion
Version: 1.8.68

The report describes junk-comment padding, generated technical word salad, plugin-list hiding, payload retrieval, and backdoor behavior. Those host-side details align with the fake-plugin design visible in the browser-facing code.

Additional host-search strings include:

ultrainfrastructurely-megaserviceive.php
ultrajavascripting-automicroserviceity.php
includes/vueor-autocloudism.php

A complete cleanup should include:

1. Inspect the full filesystem, including plugins hidden from the WordPress interface.
2. Compare WordPress core, plugins, and themes against trusted copies.
3. Review must-use plugins, uploads, cron, wp-config.php, and web-server configuration.
4. Search the web root and adjacent account directories for PHP backdoors.
5. Review WordPress administrators, hosting users, database users, and access keys.
6. Rotate WordPress, hosting, database, SFTP/SSH, and administrator email credentials.
7. Enable MFA and remove unauthorized accounts.
8. Block PHP execution in upload directories where practical.
9. Restore from a verified clean backup when available.
10. Monitor file integrity and authentication events after restoration.
11. Search for the ClickFix contract tuple and injected script stage after removing the TA2726 gateway.

Removing the fake plugin is not enough. Cleanup must cover the WordPress gateway, persistence, stolen access, and the later ClickFix injection.

---

Indicators of compromise

Same-origin routes and strings

/wp-json/platformist-quadendpointer-sxadtr/v1/s6qgn
/index.php?rest_route=/platformist-quadendpointer-sxadtr/v1/s6qgn
/wp-admin/admin-ajax.php action=multiapping_fastapiity
PH_PARAM_DIAG=1
T6cSdwTEXsJcDYRlaQf-Iw
PH_FUNC_DO_REQUEST
PH_VAR_FILTER_DATA
continueWithGatewayRequest
trivueable_autoreactment
pentaapplicationist_quickinfrastructureal
/wp-content/plugins/uniserviceist-multiinfrastructure/assets/analyze.js
/wp-content/plugins/uniserviceist-multiinfrastructure/miniclouder-smartserverless.php
/wp-content/plugins/framework-triappment/assets/hfpb6931.js

Exact hashes

Exact hashes support corroboration and historical pivots. Route and state behavior provide the primary detection anchor as token values, attributes, decisions, and response bodies rotate.

Rotating downstream infrastructure

api[.]pimparolix[.]com
api-ext[.]bixbitemarketing[.]com
platform[.]exathomeswebuyarizona[.]com
js-new[.]newtoyourgame[.]com

ClickFix EtherHiding tuple

Contract: 0xfD75a8F503be4851E11a52b645De1f017492A6b0
Selector: 0xb68d1809
Method: eth_call
Site ID: ffa65e22169204ca1ac7588970f688d7401d3ffe20656099

Public Polygon RPC endpoints provide transport. Detection focuses on the contract, selector, call method, ABI decoding, and injected script stage.

---

The gateway outlives the payload

The useful unit of analysis is the compromised site, not whichever payload appeared last. Operation Endgame disrupted SocGholish, but the exact WordPress gateway remained active through July 21. Shared hosts later carried a separate ClickFix injection.

Removing one payload does not close the site. The fake plugin, stolen access, persistence, and later injections all need their own evidence and cleanup. The payload changes; the compromised WordPress host remains the delivery point.