Amongst the PHP malwares targeting WP plugins’ vulnerabilities I encounter, some generate hundred of thousand of empty files with 0KB size in all folders and sub-folders recursively . which create diversion and affects the inodes capacity of an account. But diversion may not the only goal. as they are generated through an obfuscated code, so I can imagine that these filenames may be part of an obfuscation process. Instead of writing the directives directly in a PHP or text file, the information is gathered through the listing and ordering of the filenames, possible no? Or maybe I’m over-complicating it.

The files names seems to be randomized, following are a sample of the names:

iezbhjls.php
anybtefq.php
zblmiaqw.php
eeotdwvj.php
ghaxcehz.php
jodperix.php
wlpvfacg.php
snjlyjbp.php
jfklqacr.php
yjxgbrho.php
ncrgmjza.php
jxdtzrrs.php
vhrhfdil.php

Anyway sometimes we have files that are cleaned and emptied by our anti-malware system as well, and you may want to remove these empty files recursively

You can simply run the following command to list the concerned files:

find . -name "*.php" -size 0

If there are exclusions you may add to the command the files or their pattern not -name "file1_to_exclude.php" -not -name "file2_to_exclude.php"

Then remove them :

find . -name "*.php" -size 0 -exec rm -i {} \;

If you want to log the remove files:

find . -name "*.php" -size 0 -exec sh -c 'rm -v "$1" >> "removed_$(date +%Y%m%d%H%M%S).txt"' sh {} \;