ShapedPlugin - Diagnostic File Drop to C2 Domain Correlation

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

This rule detects the creation of the 'class-wc-subscription-diagnostics.php' backdoor file followed by a network connection to the command and control (C2) domain 'generate.2faplugin.org' within a 30-minute window on the same device. This correlation indicates a potential supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to 2FA exfiltration.