Malware That Shows AI a Clean Site: Five Real Cases With Monarx’s Aaron Campbell

A website that looks clean to the AI tool checking it, while real visitors land on malicious pages. A support ticket drafted by ChatGPT that requests a full forensic investigation. A critical WordPress flaw found with AI for about $25 in model costs. In a special episode of our podcast, Aaron Campbell, vice president of product at Monarx and a former lead of the WordPress security team, went through five cases like these with our co-founder Konrad Keck. The tricks are often old, in Campbell’s view, but AI makes them “much easier, much faster, much cheaper,” and hosts now have to work out how much of a customer’s mess they can realistically protect against.

Monarx builds server security for hosting providers and announced a partnership with Nexcess on November 10.

Cloaking, Flipped: Clean for AI, Malicious for Visitors

The first case starts with a customer reporting that their site redirects visitors to suspicious pages. Support finds nothing, and neither does an AI assistant, yet the customer is right: the malware serves different content to different visitors. Konrad’s example was Parrot TDS, a campaign whose most recent versions can detect AI crawlers and feed them “clean” content while still serving malware to people, according to Monarx’s 2025 security report.

Cloaking is an old trick, Campbell pointed out. Infected sites used to look clean to people while feeding spam to Google’s crawler. “Now as more people are using AI to clean or fix a problem, they’ve flipped that and now they’re showing bad content to real users,” he explained, while the AI sent to clean up sees “a perfectly clean site.” Malicious code could even recognize the IP range of a support team working through a VPN and always show it the harmless version. Somebody may have thought of such a trick before, he noted, “but it happens so fast and so easily now with AI.”

AI tools make support teams faster, but they are not “the solution to everything.” Staff need to know what to do when a tool reports a clean site and the customer sends a screenshot showing otherwise, for example by disconnecting from the VPN and loading the site again. In Campbell’s words, that is “a whole new set of training.”

Monarx’s approach, by his account, is to watch three layers: network traffic, the runtime where the site’s code actually runs, and every file on the server. Since “it doesn’t matter who that visitor was,” an abnormal response leads Monarx to the files behind it, which is how it found this case. “If this never becomes a support request, it’s even easier than training the teams.”

When ChatGPT Writes the Support Ticket

Many customers now consult ChatGPT before contacting their host, Konrad noted. The result is a professionally written ticket requesting server logs, the attacker’s IP address, the exact vulnerability exploited and a full explanation, often expected as part of regular hosting support. ChatGPT lacks the context, and preparing that report can take hours or even days.

These tickets can run to three or four pages, Campbell pointed out. “If a Disney had a problem, they probably would do a full forensic audit and figure it out. But if my mom’s website has a problem, she doesn’t need a full forensic audit. She needs it fixed.” His advice is to acknowledge the issue in the first couple of sentences of a reply and say it has been fixed, or what to do to fix it, because the customer generally reads that part and may feed the rest into their AI. Details can follow, although hosts do not always have them. The full backtrace of where a malicious file came from “can often be hard for hosts to even have available to themselves, much less make available to that end user.”

On cheap, unmanaged hosting at scale, with accounts at around $50 a year, investigations like that are not realistic, Konrad observed. Campbell sees these contacts as a chance for a security upsell, though not while the site is broken. A host that fixes the site first and then offers protection “can actually come across as the hero.” “No one thinks it’s going to happen to them until it does,” he added.

Monarx’s answer here is its Backtrace tool, which by Campbell’s account can often trace a malicious file back to its source, such as the WordPress plugin uploader. An October post from Monarx’s threat research team describes it as turning a forensics request into a lookup, and explains that shared hosting plans have rarely included forensics because a manual investigation can take hours or days.

WP2Shell: A WordPress Core Flaw Found With AI for About $25

WP2Shell, a chain of two flaws in WordPress core, let an anonymous request against a stock installation end in remote code execution. WordPress 7.0.2 fixed it on July 17. According to Patchstack, Searchlight Cyber ran an OpenAI model against WordPress core and had a working exploit in ten hours, at a cost of about $25. Konrad cited a count of close to 2 million attack requests in nine days. The figure comes from Japanese security company Cyber Security Cloud, which detected about 1.95 million requests after the fix, counting attempts whether or not they succeeded.

Campbell called WP2Shell “probably the most severe WordPress vulnerability that WordPress has had in maybe 10 years or so.” Yet the $25 did not replace an expert: “Somebody that really knew what they were doing was empowered by AI to do much more.” Exploitation has also sped up. When Campbell ran the WordPress security team, people watched his commits for security fixes. “But now people just have AI monitoring it full-time, and as soon as a security release comes out, it reverse engineers it and immediately starts to exploit it.” By his account, Monarx saw tens of thousands of attacks within about 5 to 10 minutes of the release.

Monarx blocked many of them, Campbell explained, because it had protection in ThreatShield, its runtime protection product, before the release went out. The WordPress security team gives a group of hosts, security companies, web application firewall (WAF) providers and CDNs a little advance notice. As the time to exploit shrinks, Campbell expects early protection of this kind to become “the new necessary standard.” In September, ThreatShield stopped more than 20,000 attempts to exploit another critical flaw, fixed in WordPress 7.1.2, according to Monarx. The company’s own WP2Shell post presents ThreatShield as “a compensating control during the exposure window, not a substitute for the patch.”

AI is changing the WordPress project itself, Campbell added. The security team used to receive a dozen or more reports a week and now gets more than one vulnerability report an hour. He traced the plugin directory’s decision to delay new releases to AI-driven supply chain attacks and hijacked developer accounts. WordPress.org announced in June that each new plugin release would be held back from auto-updates for up to 24 hours. By September, the WordPress.org Plugins Team had cut that cooldown to six hours, with several AI models and Jetpack Scan reviewing each release.

Malware That Rebuilds Itself, Even From an Admin’s Browser

A WordPress infection that “rebuilds itself faster than you can delete it” was the subject of Monarx research published in August. The infection survives in the file system, the database, WordPress’s scheduled tasks (WP-Cron) and the active theme, spreads to sibling WordPress installations on the same host, and can be restored by nine independent mechanisms. The part Monarx’s researchers found most interesting sits in the browser. On the admin and login pages only, the malware registers a Service Worker, a script the browser can run in the background, and uses the logged-in administrator’s session to reinstall the plugin. A team can wipe the server and get reinfected within hours, so the cleanup has to include every admin removing it from their browser, according to Monarx.

Monarx does clean some sites by hand, but not as the whole solution, by Campbell’s account. Manual cleans by its threat research team uncover what was not known before and become new rules for its AI. A cleanup for one customer has to apply to the whole account, and its lessons everywhere, because AI’s lower cost and higher speed make these campaigns “spread like wildfire.”

Hosts have long kept strong boundaries between accounts. In Campbell’s view, when a customer runs two or three sites in one account, similar boundaries may be needed between those individual sites. “In the new reality, we sort of have to figure out how much of a customer’s mess and mistakes and poor code can we realistically protect against?” And more broadly: “I think that we all need to take a little bit of a step back and say AI has changed things. What needs to be our new normal?”

A Zero-Day in an Up-to-Date WooCommerce Plugin

An attacker used Gift Cards for WooCommerce Pro, a paid plugin by WP Swings, to compromise a WooCommerce store on May 18. The store ran the current version, but a previously unknown flaw allowed file uploads without authentication. The attacker planted custom malware, some of it apparently AI-generated, activated legitimate plugins in ways that can create hidden administrator accounts and staged a full backup of the site for exfiltration, according to Monarx. Monarx principal security engineer Joe Bruno identified the flaw, which was published through Patchstack as CVE-2026-45444 with the maximum severity score of 10.0 and fixed in version 4.2.7.

A paid plugin of this size would once have been a poor target, Campbell noted. Monarx is seeing a lot more zero-days, which he attributes to AI letting attackers check everything they can find and exploit flaws as soon as they find them. The site owner did everything right, “at least as far as we could tell.” Cases like this show, in his view, that the old routine of identifying a flaw, patching it and rolling the patch out is “too slow.” “We have to get ahead of them now.”

By Campbell’s account, Monarx caught this attack because its runtime protection flagged activity it had never seen before: file writes that did not seem necessary and patterns that did not look human. Its threat research team then created new rules and reported the flaw. By his estimate, this runtime layer, rather than cleanup on the file system, now accounts for about 80% of Monarx’s blocks, which he reads as a sign of how many new, previously unseen attacks AI is trying.

Final Thoughts

Across the five cases, hosts face a similar problem. Support may trust the wrong view of a site, attacks can start on the day a fix is released, and deleting a malicious file may not end an infection. The practical question is what a host can detect and stop automatically, and what still needs an investigation or action from the customer.