My guess is that attackers obfuscate their PHP code for three reasons: To evade simple signature or checksum based malware detection. ... Very rarely, a malware author will put in a unique obfuscating ...

Lots of malware that afflicts WordPress, Joomla and other PHP-based web sites is written in PHP. PHP is an interpreted language, so attackers distribute malware as source code. Much of the PHP malware ...