The Situation
A mobile mechanic company with nine years in business, three counties of coverage and well over a hundred five-star Google reviews came to us with a simple brief: calls had become inconsistent and nobody could say where they came from. The Google Business Profile had two categories, the website had been built by a previous provider on a heavy theme, and the owners — who fix trucks, not servers — had been told by that provider that everything was fine.
The profile audit took an hour. The website took a day, and it changed the engagement.
What We Found
The site's sitemap listed 470 URLs. Four were real pages from 2024. The other 466 were casino and gambling pages in a foreign language, all injected between the 25th and the 29th of March 2026, five days after an intruder had created a hidden folder on the server. Google had indexed them over the following weeks, and the organic traffic chart showed exactly when: it fell from May onward.
That part is common. What was not common was underneath it.
- A 6.7 MB backdoor in the folder WordPress loads on every page view and never shows in the plugin list, disguised with a fake plugin header under a different name.
- A second file, loaded even earlier in WordPress's boot sequence, whose only job was to reinstall the backdoor if it was removed.
- Two administrator accounts created by the attacker in March and April. The only other administrator was the previous provider's account, which had been compromised. Nobody at the business had admin access to their own website.
- A rotation scheme: the malware wrote a fresh spare file every month, always on the 16th, under a new name.
We removed the backdoor. It was back in under a minute. We removed it again; it came back larger and added two new folders. We stopped there, took a full verified backup, rotated the site's security keys — which killed 136 active login sessions the intruder had open — preserved the evidence in quarantine, and wrote it all up for the client in plain language.
What We Did Not Promise
We told the owners we could not guarantee the site was clean, and that anyone who promised them otherwise was guessing. A program built to survive deletion on a server where someone else has had administrator access for six months is not a cleanup job; it is a rebuild job. We quoted the rebuild, credited what they had already paid for the diagnosis toward it, and told them it was their decision to make.
They chose to wait. We wrote that down and did not raise it again.
Keeping The Calls Coming Meanwhile
The profile is where most of a mobile mechanic's calls come from, and the profile was not infected. So while the website decision sat with the client, the monthly work went there:
- Categories from two to ten, verified against the services they actually sell — and one category the owner asked for that we declined to add, because listing it publicly is a federal compliance problem for a mechanic even when the work itself is routine.
- A new description, after we found the old one promised 24-hour service the company does not offer.
- The profile's website link pointed at a clean secondary site the company already had, with every phone number on it made tap-to-call. Before that, the site had zero clickable numbers.
- A review kit: a printed card and sticker with a direct review link for every technician's clipboard. Reviews had been arriving at roughly one a month for nine years. Two weeks after the kit went out, the count had moved from 135 to 141.
- Weekly posts from the technicians' own job photos, with customer names, fleet numbers and other companies' phone numbers blurred before publishing.