LinkHiding SEO spam kit

The backdoor loads before the page

LinkHiding is a PHP backdoor planted before a WordPress site's normal HTML. It stands down during WP-CLI, cron, AJAX, REST and administrator requests, then attaches its changes to public page hooks.

The code gives its remote server several controls. A /links?site= request can return ordinary link rows, homepage links, a canonical URL for the current path and a path-specific redirect. A separate /active-slugs?site= response lists search-spam paths to maintain. For one of those paths, /page?site=...&path=... can supply the status and HTML for a generated page, replace existing content or append to it.

Link insertion is reserved for Googlebot. The backdoor adds a collapsed More section with the supplied links in the footer and can add a second set on the homepage. Canonical tags, redirects and remotely supplied pages are handled through separate WordPress hooks.

Ethereum is a controller failover

LinkHiding starts with a controller domain embedded in the PHP and stores the active value in a WordPress transient named _dm. It sends short HTTP requests to that controller and tracks failures in _fc. After five failures, it calls Ethereum mainnet contract 0x8b51674f44a1aa39ad5b3a365da1d667e54af292 with selector 0x3fa4f245, rotating among five public RPC services with _ri, and reads the reply as a right-aligned bytes32 string holding the replacement domain. On 1 November 2026 it returned placeholderlink[.]com. Requests go to the links. and pages. subdomains of whichever domain is active.

The remote data is cached at different speeds: link instructions for 10 minutes, active slugs for an hour and generated pages for two days. Those intervals let the operator change links quickly while keeping whole spam pages available through short outages.

What we see

Month	New sites
September	3
October	0
November so far	0

WordPress runs on 67% of captured sites.

Finding LinkHiding in WordPress

Search loaded PHP, themes, plugins and must-use plugins for the marker v82L4MZsM3tIW0wK, functions that use _dm, _fc and _ri, selector 0x3fa4f245, or requests ending in /links?site=, /active-slugs?site= and /page?site=. Review code that adds footer links only for Googlebot, path-specific canonical tags, redirects, or content on a 404 response.

Remove the injected PHP and replace the affected component with a trusted copy. Clear the _dm, _fc, _ri, link, slug and generated-page transients so cached instructions cannot continue changing output.