SEO Cloaking and NOX in a WordPress Compromise
An apparent website defacement led to a JavaScript redirect, live SEO cloaking, and recovered PHP tools. The investigation shows why browser evidence, crawler responses, and file findings need to be tested separately.

