WordPress __GA_INJ_START__ backdoor: hidden admins + theme injection reconstructed from DB and access logs

I recently investigated a compromised WordPress installation and found a malware pattern that I haven't been able to find properly documented by a security vendor. The most recognizable marker is injected into the active theme: /* __GA_INJ_START__ */ ... /* __GA_INJ_END__ */ The incident was interesting because I had access to the WordPress DB,...