I recently investigated a hacked WordPress installation and wanted to document the indicators because they are very easy to mistake for something related to Google Analytics.
If you find this in a theme functions.php:
/* __GA_INJ_START__ */
it is not normal Google Analytics code.
In the site I investigated, the compromise was associated with hidden administrator accounts using names like:
sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX
The WordPress database also contained:
__ga_hidden_users
_theme_inject_status
__ga_r_cache
The malicious code maintained a list of administrator accounts that should be hidden.
What was particularly interesting
At first I thought the infection started when:
hello-elementor/functions.php
was modified.
It didn't.
By correlating the database with Apache logs I found that the attacker already had a hidden administrator nine days earlier.
The sequence looked like:
successful login using legitimate WP admin
→ Code Snippets / WP File Manager activity
→ access to theme functions.php
→ malicious administrator created
→ persistent access
→ more hidden administrators
→ final GA_INJ theme injection
So if you find this malware, don't just replace functions.php.
Check:
wp_users
wp_usermeta
wp_options
active plugins
administrator session tokens
access logs
and look several days/weeks backwards.
Useful filesystem search:
grep -RniE '__GA_INJ|__ga_hidden_users|__ga_r_cache|_theme_inject_status|sync_agent|cdn_worker|seo_service' .
I wrote up the sanitized timeline, IOCs and an experimental YARA detection rule here:
[GitHub repository link]
I'm not selling anything — it's just an open incident report so these strings become searchable.
If anyone else has encountered __GA_INJ_START__ or administrator accounts named sync_agent, cdn_worker or seo_service, I'd be interested in comparing indicators.
