Wacatac Malware Embedded in ExpressionEngine Plugin Downloads

Initial Signal

On February 10, 2026, Microsoft Defender for Endpoint detected Wacatac malware in ZIP files downloaded by user_1 on machine ws-001.[INTERNAL_DOMAIN_1].local. The detection escalated on February 13 when the same malware was found in extracted PHP files. The malicious file, `FreeformHelper.php`, carries SHA1 hash `103fe8ca80f50838e61d5709a023d4c3c7c6e11f` and is consistently identified as `Trojan:Script/Wacatac.C!ml` — a script-based trojan rather than a compiled executable. What made this signal noteworthy was its context: the file appeared in multiple locations within ExpressionEngine Freeform plugin directories, suggesting the malware was embedded in what appeared to be legitimate CMS plugin packages rather than downloaded as a standalone threat. The file's extremely low global prevalence (1 in Microsoft's telemetry) and small size (399 bytes) are consistent with a targeted malicious script, not a false positive or benign utility. The investigation correlated data from Microsoft Defender for Endpoint alerts, XDR advanced hunting, and file prevalence analysis across 10 invocations, completing in 2 minutes 35 seconds and covering 19 total records from three data sources.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Verified consistent malware identification across multiple detections
   Pass
2. fp2
   Analyzed file prevalence and characteristics
   Pass
3. fp3
   Examined file location patterns and context
   Pass
4. fp4
   Evaluated detection progression over time
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Malicious at high confidence rests on the following mutually corroborating signals:

1. Consistent identification of FreeformHelper.php as Trojan:Script/Wacatac.C!ml across multiple detections with identical SHA1 hash 103fe8ca80f50838e61d5709a023d4c3c7c6e11f, eliminating the possibility of a single false positive

2. Extremely low global prevalence

3. in Microsoft Defender telemetry, indicating the file is rare and not a common legitimate utility

4. File characteristics (399 bytes, non-PE PHP script) are consistent with a malicious script designed to execute in web environments, not a benign tool

5. Detection pattern across multiple plugin directories suggests deliberate embedding in software packages, not accidental or coincidental presence

6. Analyst notes confirm this was treated as a genuine security incident requiring remediation and escalation to the Service Desk. Confidence is High rather than Confirmed because the malicious files were detected in Veeam backup snapshots rather than in active system execution, leaving a small gap in evidence of actual exploitation or persistence on the live system

Lessons

1. 01
   Backup snapshots can hide active threats. In this investigation, malware was detected in Veeam backup snapshots, which initially suggested the files were dormant. However, backups capture a point-in-time view and do not indicate whether files executed before or after the snapshot was taken. Always cross-reference backup detections with live system telemetry and process execution logs. If live system data shows no execution, the threat may still require remediation to prevent future activation if backups are restored.
2. 02
   Low prevalence is a strong malware signal. The FreeformHelper.php file had a global prevalence of 1 in Microsoft Defender's telemetry. This extreme rarity, combined with consistent detection as Trojan:Script/Wacatac.C!ml across multiple locations, was a key confidence driver. When evaluating file detections, prioritize files with prevalence scores of 1–5 over those with higher prevalence, especially if they appear in unexpected directories like plugin folders.
3. 03
   Supply chain threats embed in legitimate packages. The malware was found within ExpressionEngine Freeform plugin directories, suggesting it was embedded in what appeared to be a legitimate software package. This is a classic supply chain compromise pattern. Monitor plugin and third-party software downloads for hash mismatches against official repositories, and flag any extracted archives containing files not documented in official release notes.
4. 04
   File hash consistency rules out coincidence. All instances of FreeformHelper.php shared the identical SHA1 hash 103fe8ca80f50838e61d5709a023d4c3c7c6e11f across multiple locations. This consistency eliminated the possibility of a false positive or unrelated file with the same name. When investigating malware, always verify hash matches across detections to confirm you are tracking the same malicious artifact.
5. 05
   Normal login patterns do not rule out malware. User user_1 showed consistent, normal authentication patterns with no failed logins or suspicious access. This ruled out account compromise but did not rule out malware in downloaded files. Separate your analysis: account compromise, system compromise, and malware presence are distinct threats. Normal login activity can coexist with malware inadvertently downloaded by the user.