WordPress malware hides as a must-use plugin and uses blockchain C2 to steal data and persist on compromised sites.