After coming across a post on /r/netsec about some new PHP malware called GetMama I was happy to help the guy analysing the code into getting hold of a bit more of its payload.

When he looked at the new code he found the following about the malware:

The attacker finds a vulnerability that allows arbitrary php execution in a server. Then he or she executes this file using that vulnerability, which in turn infects all the other PHP files with the GetMama malware. Then the GetMama receives instructions, one of them possible being loading this file again to infect even more PHP files, for example.

From the small amount of PHP malware I’ve seen, attacks like this usually inject some JavaScript into the source compromising any user of the site and their activities.