Hackers Abuse WordPress MU-Plugins to Hide Malicious Code

The technique was first observed by security researchers at Sucuri in February 2025, but adoption rates are on the rise, with threat actors now utilizing the folder to run three distinct types of malicious code.