WordPress Drive-by: nochain-sw.js Service Worker Dropper Files

Ankit Mehta@Secvyn

•updated Sep 7, 2026•0•0•0

Detects the creation or modification of specific dropper/loader files and service worker registration within WordPress directory structures (wp-content/plugins, wp-content/themes, wp-content/uploads). These files are often associated with the injection of malicious scripts (e.g., on-chain resolvers) to facilitate drive-by compromises by site visitors.