Hackers are exploiting wordpress mu-plugins to conceal malicious code, potentially allowing them to inject spam, hijack site images, or maintain admin access. The exploitation may involve using image tags to deploy payment skimmers or creating stealth backdoors for persistent access. The nature and scope of the exploitation are still being reported, with varying details emerging about the methods and goals of the hackers.