Sucuri has discovered multiple malware families deployed in the WordPress mu-plugins directory to evade routine security checks.