Threat actors are using the « mu-plugins » directory in WordPress sites to conceal malicious code with the goal of maintaining persistent remote access and redirecting site visitors to bogus sites.
mu-plugins, short for must-use plugins, refers to plugins in a special directory (« wp-content/mu-plugins ») that are automatically executed by WordPress without the need to enable them explicitly via the
