The challenge
This is the infection that survives a cleanup. A client came to us with ten WordPress sites on one shared hosting account, all compromised as part of a Japanese search-engine spam operation. The malware was cloaked: real visitors saw the normal sites, while Google’s crawler was served thousands of hidden spam pages that hijacked the sites’ search standing to promote the attacker’s own URLs.
For a business whose value is the traffic those sites earn, that is an existential threat rather than a nuisance, because a search engine that keeps finding spam and cloaking on a domain eventually stops trusting it. And it had already beaten every attempt to remove it. The host’s own scanner and the client’s team had cleared the visible malware repeatedly, around eight times on one site alone, and each time it came back within hours.
The approach
The reason standard scan-and-delete kept failing was a hidden mechanism nobody had reached yet, so finding it was the whole job.
We started by making “clean” measurable rather than assumed, mapping every site, database and account and building a reliable test for whether a site was still serving spam. Then we cleaned all ten sites carefully, file by file, taking a full backup of each first. When one site reinfected overnight with every credential already rotated, that single fact reframed the case: passwords were never the way in. We reconstructed exactly what had changed, traced it to a small auto-loading file that reinstalled the entire spam kit on every page view, and decoded it by hand through several layers of obfuscation to prove what it did. That self-rebuilding backdoor was the persistence mechanism defeating every prior cleanup, and widening the search across the estate turned up more hidden tooling, including a full database program disguised as an ordinary plugin.
With the root cause identified, we removed it across all ten sites and rotated every credential, including the internal security keys that force out any stolen login session, which a password change alone does not do. We rebuilt our own scanner after catching a blind spot in its first version, then re-verified every site against the stronger tool and a live crawler-view test. We cleaned the poisoned search instructions from all ten sites and cleared a long-lived copy the attacker had planted in the CDN cache to outlast a normal cleanup. Finally we hardened each site and set up an automated daily scan with alerting.
The results
All ten sites are clean, independently verified and stable, confirmed by a dedicated watch period during which the site that used to reinfect within hours stayed clean. The recurring, escalating reinfection problem is closed, and the mechanisms that let it persist are gone.
The headline outcome is what did not happen. Google applied no manual penalty, because the cloaking was stopped before it did lasting damage, so the sites’ search standing was protected rather than recovered. For a traffic-dependent business that is the difference between a scare and a catastrophe. The client was left with a hardened estate, a custom scanner running every day, clean search instructions across all ten sites, and monitoring to catch anything similar early.
