I recently investigated a hacked WordPress installation and wanted to document the indicators because they are very easy to mistake for something related to Google Analytics.

If you find this in a theme functions.php:

/* __GA_INJ_START__ */

it is not normal Google Analytics code.

In the site I investigated, the compromise was associated with hidden administrator accounts using names like:

sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX

The WordPress database also contained:

__ga_hidden_users
_theme_inject_status
__ga_r_cache

The malicious code maintained a list of administrator accounts that should be hidden.

What was particularly interesting

At first I thought the infection started when:

hello-elementor/functions.php

was modified.

It didn't.

By correlating the database with Apache logs I found that the attacker already had a hidden administrator nine days earlier.

The sequence looked like:

successful login using legitimate WP admin
→ Code Snippets / WP File Manager activity
→ access to theme functions.php
→ malicious administrator created
→ persistent access
→ more hidden administrators
→ final GA_INJ theme injection

So if you find this malware, don't just replace functions.php.

Check:

wp_users
wp_usermeta
wp_options
active plugins
administrator session tokens
access logs

and look several days/weeks backwards.

Useful filesystem search:

grep -RniE '__GA_INJ|__ga_hidden_users|__ga_r_cache|_theme_inject_status|sync_agent|cdn_worker|seo_service' .

I wrote up the sanitized timeline, IOCs and an experimental YARA detection rule here:

[GitHub repository link]

I'm not selling anything — it's just an open incident report so these strings become searchable.

If anyone else has encountered __GA_INJ_START__ or administrator accounts named sync_agent, cdn_worker or seo_service, I'd be interested in comparing indicators.

I recently investigated a compromised WordPress installation and found a malware pattern that I haven't been able to find properly documented by a security vendor.

The most recognizable marker is injected into the active theme:

/* __GA_INJ_START__ */
...
/* __GA_INJ_END__ */

The incident was interesting because I had access to the WordPress DB, filesystem timestamps, PHP error logs and Apache access logs, which allowed me to reconstruct the compromise.

Main IOCs

Database options:

__ga_hidden_users
_theme_inject_status
__ga_r_cache

Hidden administrator naming patterns:

sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX

Actual accounts from this incident:

sync_agent56b7752b
cdn_workerbc36d5f6
seo_service06893f6c

All had administrator privileges.

One remote domain was stored in the database:

rukkoldauwe87[.]xyz

Timeline

On August 5 several IPs successfully authenticated to /wp-login.php as the legitimate administrator using automated clients including curl/Wget.

Later:

successful administrator login
→ Code Snippets activity
→ WP File Manager activation
→ browse to hello-elementor/functions.php
→ POSTs to admin-ajax.php
→ hidden administrator created seconds later

WP File Manager requests contained a Base64-encoded target which decoded to:

wp-content/themes/hello-elementor/functions.php

The first malicious administrator was created immediately afterwards.

On August 14 two additional hidden admins appeared and hello-elementor/functions.php was modified with the __GA_INJ_START__ payload.

The database contained a list of exactly those accounts under:

__ga_hidden_users

The malformed PHP injection eventually caused:

PHP Parse error: Unmatched '}'

which is how the compromise was initially noticed.

An important point is that the theme modification happened nine days after the first confirmed malicious administrator was created, so using the PHP file modification timestamp as the incident start would have missed most of the compromise.

I have published a sanitized incident report containing the timeline, IOCs and an experimental YARA rule:

[GitHub repository link]

No live malicious links or credentials are included.

I'm particularly interested in whether anyone has seen these exact identifiers before:

__GA_INJ_START__
__ga_hidden_users
_theme_inject_status
sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX

Does this malware family/campaign already have a known name or published analysis?

The remaining unknown is the initial-access vector. The logs clearly show valid authenticated WordPress admin sessions before the persistence mechanisms were installed, but they don't establish how those credentials/session tokens were originally obtained.