Vitrina Site Connector and SEO Client: the cloaked WordPress injector

In wp-content/mu-plugins/ you found a file named wp-http-transport.php or wp-seo-client.php — or a mu-plugin presenting itself as “Vitrina Site Connector” or “SEO Client”. You didn’t install it. It’s a cloaked injector: a malware family we documented by cleaning it off real-world sites, and one most scanners don’t detect.

What is Vitrina Site Connector / SEO Client?

It’s a redirect injector hidden in WordPress’s must-use plugins. Its distinctive trait: the code is clean, non-obfuscated, written like a real object-oriented plugin. It contains no eval() and no base64 — none of what classic antiviruses look for. At runtime, it contacts a remote server (C2) to fetch a destination, then redirects a share of visitors to a casino or displays it in an iframe.

We encountered it as two complementary components: a loader named wp-http-transport (Vitrina Site Connector) and a wp-seo-client module (SEO Client), with a command server on the domain dillduck24[.]info.

How it works

• Stealthy location: mu-plugins run automatically, don’t appear in the plugins list and can’t be deactivated from the admin.
• Beacon to a C2: the plugin calls a remote endpoint (e.g. /vitrina/api/gate.php or /seo-client.php) to receive its instruction at request time. The payload isn’t in the file — it arrives live.
• Response protocol: the server returns tags like <redirect> or <frame> that the injector interprets to redirect or frame the page.
• Cloaking: the redirect is conditional (visitor not logged in, robots excluded or targeted depending on the case). A logged-in admin sees nothing.
• Database spam: the family often comes with injected posts whose author field (post_author) falls outside the normal range — typically between 999 and 9999.

Symptoms

• One or two unknown mu-plugins: wp-http-transport.php, wp-seo-client.php.
• A casino redirect reported by visitors, invisible to you.
• Spam posts in the database attributed to abnormal author IDs.
• No result from classic antiviruses, despite real symptoms.

How to check if you’re infected

Over SSH:

ls -la wp-content/mu-plugins/
grep -rn "vitrina\|seo-client\|http-transport" wp-content/mu-plugins/
grep -rEl "<\s*redirect\s*>|<\s*frame\s*>" wp-content/ --include=*.php

On the database side, look for posts whose author falls outside the range of your real accounts. The free WP-Detox scan includes behavioural detection of this family: it spots the injector that emits remote content and the cloaking, where signature scanners fail.

Removing it properly

1. Back up the current state (files + database).
2. Delete the mu-plugins wp-http-transport.php and wp-seo-client.php, along with any unknown mu-plugin.
3. Purge the database spam: the injected posts with abnormal authors (see removing casino spam posts).
4. Hunt for companion backdoors: this family arrives after a break-in, so there are often other doors — see finding and removing a backdoor.
5. Close the flaw and rotate every credential (admin, database, FTP, salt keys).

How it comes back (persistence)

The injector doesn’t store its payload: it fetches it from the C2 on every request. Removing a spam display is therefore pointless while the mu-plugin is there — it re-injects on the next visit. And if the original access (compromised admin or FTP) isn’t closed, the attacker simply re-drops the mu-plugins. The cleanup is only complete once both loaders are removed, the database spam purged and the entry point closed.

FAQ

Why doesn’t my antivirus detect Vitrina Site Connector? Because the code isn’t obfuscated: it’s clean, well-written PHP that looks like a real plugin. Scanners hunting for patterns like eval() or base64 miss it. What gives it away is behavioural detection — the cloaking, the beacon to a remote server, the abnormal author range.

I don’t see any redirect on my site — am I still infected? Possibly. The injector cloaks: it only fires the redirect for certain visitors and never for a logged-in admin. No visible symptom for you proves nothing; you need to check for the mu-plugins and the beacon.

Is deleting the two mu-plugins enough? That’s the core, but not always everything. This family often comes with spam posts in the database (authors 999-9999) and sometimes other access. You have to remove the mu-plugins, purge the database spam and close the entry point.

---

We identified and cleaned this family on real-world sites — which is what let us add its behavioural detection to our scanner. The scan is free, the cleanup takes about 30 minutes, it’s €149 excl. VAT and refunded if the site isn’t clean. For the big picture, start with the complete guide to cleaning a hacked WordPress.