Eleven sites on one hosting account, cleaned in one sweep
Trades business, UK
WordPress × 11
Malware removal, account-wide
Oct 2026
sites cleaned in a single coordinated pass
evening session, 16 October 2026
login with the owner’s password identified as the probable way in
A self-healing loader kept reinstalling itself across every WordPress site on the account, from files, the database and server memory. A service worker planted in administrators’ browsers kept handing the attackers new logins, even after the files were clean.
Mapped every site on the account instead of cleaning one in isolation
Contained all eleven sites at the same moment, then removed the loader and every copy of it in one evening session
Removed the service worker from administrators’ browsers before any new password was typed
Traced the entry to a login with the owner’s own password (rated probable, not proven) and changed every password
Eleven sites reinfected within hours of every hand clean-up, hidden administrators on each.
All eleven cleaned and verified together; hidden administrators and the browser service worker removed.