New evidence points to a central server that delivers the malicious content and payloads via compromised Wordpress sites