Over the course of 2026, this site published detailed write-ups of real website compromises: online stores, business sites, shared hosting accounts and entire servers. Most were routine in their entry point and unusual in what came after. This review collects the cases that stood out for their impact or for how hard they were to see, with a short summary of each and a link to the full analysis.
The list is not a ranking of attackers or a commentary on any vendor. It is a record of techniques that were observed in the wild this year, grouped by what they put at risk. All identifying details were removed in the original articles and remain removed here.
💳 Payment card and data theft
These cases did the most direct harm to third parties: the customers and users of the affected sites.
Server-side Magecart inside Magento's checkout code
A card skimmer was injected into the PHP files that process payments for both registered and guest customers. Because it worked on the server, it left no JavaScript in the browser for content policies or page scanners to notice, and it encrypted stolen card data before sending it out. It had been running for more than seven months, hidden behind a noisier redirect injection that was found first.
A checkout skimmer appended to RequireJS
The skimmer lived at the end of the JavaScript loader that every Magento storefront page loads first, inside generated static files that developers rarely read. It showed a fake card form only at checkout and only to about half of visitors, and companion image backdoors put it back after it was first removed.
A skimmer hosted in someone else's Google Tag Manager container
Nothing malicious existed on the server. The store carried one ordinary-looking tag manager line in its settings, but the container ID belonged to the attacker, and the skimming logic ran from that container at checkout. File scans, database searches and integrity checks had nothing to find.
A fake WordPress add-on that exported credentials every hour
Disguised as a companion to a popular form plugin, a modular data-theft framework collected password hashes, session data and the site's configuration, then uploaded it on a schedule to a free public JSON storage service. The traffic looked like any plugin calling a developer API. A loud gambling-spam infection on the same site drew attention away from it for weeks.
♻️ Malware that rebuilds itself
A recurring theme of 2026 was malware designed to survive deletion. In each of these cases, removing the files was not enough, because the real payload lived somewhere file-based tools do not look.
A WordPress malware framework with 15 persistence layers
The most advanced family documented this year stored its encrypted code in the database, spread across many randomly named rows, and treated files on disk as disposable. Fifteen independent mechanisms could each rebuild the others, its command channel ran over a blockchain, and it was confirmed on more than 1,200 WordPress sites. On affected servers, scanners and the malware fell into an endless delete-and-regenerate loop.
MySQL triggers that undid every cleanup
On a site with thousands of spam posts and dozens of rogue administrators, database triggers silently restored spam links every time the content was edited. Combined with scheduled tasks and plugin auto-activation, this caused six earlier cleanups to fail before the mechanism was identified.
The phantom administrator
A five-layer compromise hid an administrator account from the dashboard and from WordPress's own command-line tools, exposed remote code and SQL execution through the REST API, and rebuilt deleted files from the database. Visitors meanwhile saw a fake Cloudflare check that tried to get them to run malicious commands.
🖥️ Beyond the website: server-level access
Some compromises did not stop at the web application. In these cases, attackers gained an interactive foothold on the server itself, which no amount of website file cleanup would have removed.
A Go command-and-control agent disguised as a kernel thread
An OpenCart store was breached in two waves. In the second, a playbook deployed a header-triggered PHP webshell, a customer-data exfiltration endpoint, a 5.6 MB compiled agent posing as a Linux kernel process, and scheduled tasks to restart it, all within 21 minutes. PHP-focused scanning would never have seen the agent.
Reverse shells hidden with terminal escape codes
Two encrypted reverse-shell backdoors on a Joomla server were started from the scheduled tasks and shell start-up files. The entries were wrapped in escape sequences that erase themselves when printed in a terminal, so the files looked empty or harmless to anyone reading them.
An attacker still active during the response
On a hosting account with 55 WordPress installations, an in-memory reverse shell kept the attacker connected after its binary had been deleted from disk. New webshells appeared on already-cleaned sites within a minute of removal, and the access logs recorded the attacker reacting in real time.
🎭 Turning visitors into victims
ClickFix, a fake "verify you are human" page that tricks people into running a command on their own computer, was one of the most frequent payloads of the year. Two cases showed how far its delivery has evolved.
ClickFix delivered through smart contracts
A short injection in a WordPress configuration file rewrote every page through PHP output buffering, using only common functions that malware signatures do not flag. The address of the fake verification page was not stored on the server at all. It was read at runtime from a smart contract on a public blockchain test network, where it cannot be taken down.
A supply-chain attack that installed plugins through the admin's own browser
For a few hours, a third-party widget script loaded by many websites was replaced with a ClickFix version. When the visitor was a logged-in WordPress administrator, the script used their session to upload and activate a small backdoor plugin. The plugin fetched its payload from a feed whose target domain changed every few weeks.
🌐 Mass exploitation and long-term footholds
The last group covers vulnerabilities exploited at scale and access that was in place long before anyone noticed.
Fifty Joomla sites defaced in 48 hours
A botnet used CVE-2026-49049, an unauthenticated flaw in a widely used Joomla template framework, to write defacement code straight into template settings in the database. No file on disk changed. Unpatched end-of-life Joomla 3 sites were hit by the same campaign through other known flaws.
A single sign-on flaw that handed out admin sessions
A management plugin's single sign-on feature could be made to sign its own login tokens for an unauthenticated caller. Automated waves from several addresses logged in as administrator without credentials and installed fake plugins faster than they could be removed, with no persistence on the server at all.
CosmicSting webshells disguised as images
Attackers exploiting CVE-2024-34102 in Magento dropped webshells that are valid JPEG images and valid PHP at the same time, with extensions that extension-based scans skip. The case also showed why a patch alone does not end the risk: a store encryption key stolen before patching remains usable until it is rotated.
A nulled theme with a two-year-old backdoor
A defacement led to about a dozen small remote-execution backdoors. File timestamps showed they had arrived two years earlier, together with a pirated copy of a premium theme the owner had installed. The recent attack simply used a door that had been open since then.
🧭 What these cases have in common
- The database is a hiding place. Self-healing frameworks, triggers, template settings and tag manager references all kept malicious logic out of the file system.
- Trusted infrastructure is borrowed. Google Tag Manager, public JSON storage, blockchains and a legitimate vendor's CDN were all used to host or locate payloads.
- Attacks choose their audience. Skimmers fired only at checkout, phishing hid from administrators, and cloaked spam was shown only to search engines.
- The visible symptom is often a decoy. Spam and redirects were found first in several cases, while the quieter theft or backdoor kept running.
- Access can be old. Some footholds were months or years older than the incident that revealed them.
❓ Frequently asked questions
How were these cases selected?
They are cases published on this site in 2026, chosen for their impact on site owners and visitors (payment and credential theft, server-level access, mass exploitation) and for how difficult the technique was to detect.
Do the original articles contain identifying information?
No. Every write-up was sanitized. Names, domains, IP addresses and other details that could identify an affected site were removed before publication.
Where can I read the technical details?
Each summary above links to the full article, which covers how the technique worked and how it can be detected.
