The Malware That Hides From Everyone Except Your Customers: Inside Cloaked WordPress Attacks in…

If you run a WordPress site, you've probably been told: install a security plugin, run regular scans, and you're covered. In 2026, that advice is dangerously incomplete.

What Cloaking Actually Means

Cloaked malware doesn't hide by being undetectable — it hides by being selective. The malicious script checks who's requesting the page. If it's a search engine bot, a security scanner, or the site owner, it serves clean, normal content. If it's a real visitor, it serves something else entirely — often a redirect to spam pages, fake stores, or phishing sites.

Some of the more advanced variants (documented in recent WordPress security research) go a step further: they can now identify AI crawlers — the bots used by ChatGPT, Gemini, and similar tools — and serve them clean content too, while continuing to exploit human visitors undetected.

Why This Matters for Business Owners

This means the two things you'd normally trust — "my scanner says it's clean" and "my rankings look fine" — can both be true while your customers are actively being redirected to something harmful. The first sign is often not a scan alert. It's a customer complaint, an odd bounce-rate spike, or a sudden drop in trust signals.

What To Actually Check

• Compare what a bot sees vs. what a real browser (logged out, different IP/location) sees
• Review server logs for unusual redirect patterns, not just plugin scan reports
• Don't rely on a single scanner — cloaking is specifically designed to evade them

Security in 2026 isn't about having a scanner installed. It's about knowing what a scanner can't see.