“If you are familiar with PHP/WordPress, you’ll notice that [the attack] is adding the output of this function (counter_wordpress, which calls 91.196.216.30/bt.php) to the header of the ...