Master Guardian: Pharma Spam Network Hiding as a Security Plugin

‍

‍

Between early and late October, Monarx observed files from this toolkit spread across numerous hosting accounts and over a thousand servers, reported by dozens of hosting partners. Activity jumped in late October, when a second layer of the toolkit appeared, and has grown every day since. Event counts are significantly larger than account counts because the plugin rebuilds itself every few minutes. Monarx automatically recognized and quarantined all the file events logged. Even when the plugin rewrote itself, we automatically eliminated the main control plugin alongside all the others.

What the attacker installs

The toolkit is a set of plugins that all list the same fake author, "SiteGuard Tools". Each one has a harmless-sounding description. Together they publish the spam, hide it, and keep it alive.

The design is the point. If an owner deletes one plugin, another restores it. If the owner looks at their posts, the spam is not listed.

What the attacker is after

This is an SEO spam operation, search engines trust established websites far more than new pharmacy sites, so attackers borrow that trust by publishing their pages on hacked ones.

The code shows how the operation is run:

• Pages are made to order. pono.php accepts a title, body, image and drug name. The plugin stores the drug and a target country with each post, and the schema plugin builds prices in that country's currency. If no job is sent, the script fetches one from boostrabcdn[.]com or any other compromised domain.
• The operator keeps a list of live pages. After each post is created, the script sends its address back to an address the operator supplies, so they know what to submit to search engines.
• Rivals are removed. Defence Spam deletes posts with casino and gambling words. Those are the topics other spam operators use on the same hacked sites, so the "anti-spam" feature clears the way for the pharma pages.
• The owner is kept in the dark. Posts by one hidden user are removed from every admin list and count. The hidden footer links only matter to search engines.
• The spam is dressed up as shopping results. The fake ratings, review counts and prices are the details search engines use for product listings.

Monarx can see the plugins and the pages' publishing mechanics. We do not see the page contents or where visitors end up, because the text comes from the operator's servers when each page is created.

Is this a known campaign?

We did not find a public report that names it. Three public reports describe the same family of problem:

• Pharma spam on hacked sites is an old, steady business. Attackers breaking into legitimate sites to promote prescription drugs, because search engines rank trusted domains more readily than new shady pharmacies.
• Fake plugins on hacked WordPress sites are not new either. Rapid7 reported a ClickFix campaign on more than 250 compromised WordPress sites in at least 12 countries, active since December 2025. How the attackers got in was not confirmed.

What looks different here:

• The pages are published as normal posts on the victim's own domain, through a publishing backdoor, and not as redirects or loose HTML files.
• The operator hides the posts from the owner by user ID, so they never appear in the admin.
• The toolkit presents itself as security software, and rebuilds itself from a private GitHub repository when removed.
• The "anti-spam" code deletes other spammers' posts.

Indicators of compromise

Addresses and domains are written with brackets so they cannot be clicked by accident. Attackers can change infrastructure at any time, so use these as a starting point for log review, not as a blocklist.

Files and folders

In the database

Domains

IP addresses seen performing admin actions

File hashes (SHA-256)

Recommended actions for website owners

If any of the files above are on your site, treat it as fully compromised. Deactivating the plugins in the WordPress screen will not work, because they switch each other back on.

• Check for the toolkit. Look in wp-content/plugins/ and wp-content/mu-plugins/ for the folders and files listed above, and check wp-admin/network/ for pono.php. Must-use plugins do not show in the normal plugin list, so check the folder itself.
• Limit admin access while you clean. The plugins reinstall themselves when someone loads the admin area. Put the site in maintenance mode or restrict /wp-admin/ by IP address.
• Delete the files from the server, all at once. Use SFTP, SSH or your host's file manager. Remove Master Guardian and Watch Guardian together, then the other plugins, the two mu-plugins and pono.php. Check again after ten minutes to confirm nothing came back.
• Remove the spam content. Find posts and pages written by malicious admin users, and anything with _rx_drug meta. Delete them, along with the guardian_ and sps_ options.
• Change every credential. Reset all administrator passwords, end all active sessions, and look for admin users you do not recognize. Also change hosting, SFTP, SSH and database passwords. The campaign relies on stolen admin logins.
• Turn on two-factor login for every administrator account.
• Remove what let them in. Delete file-manager plugins you do not need.
• Clean up search results. Search Google for site:yourdomain.com plus drug names, remove the spam URLs in Search Console, and resubmit your real sitemap.
• Review your logs for logins and plugin installs from the IP addresses above.

Recommended actions for hosting providers

• Search your servers for the plugin folder names, pono.php, and the hashes above, including mu-plugins folders.
• Alert on plugin installs and logins to many unrelated sites from a single IP address. Two addresses in this campaign did exactly that on hundreds of sites.
• Block or watch outbound requests to the three domains above and to GitHub's API from web processes.
• Do not rely on quarantine alone. Remove Master Guardian and Watch Guardian first, or the toolkit will rebuild itself.