diff --git a/build-baseline.sh b/build-baseline.sh
index bdf5917f..35a35ed5 100755
--- a/build-baseline.sh
+++ b/build-baseline.sh
@@ -73,11 +73,27 @@ fi
 # the live divergence until live is re-deployed or the drift is reconciled.
 # Line-ending normalization is intentionally left to the verifier, not applied here.
 
-# 6) Safety net — malware IOC + scan artifacts must never appear in the baseline
-#    (the sources above already exclude them; this is defensive, documented in
-#    malware-iocs.md / malware-iocs.paths).
-log "exclude: malware IOC + scan artifacts"
+# 6) Safety net — CONTENT-based malware exclusion. The constituent sources above
+#    are vetted clean, but this catches a planted file regardless of its extension
+#    disguise. The 2026 incident planted one webshell under ~20 fake extensions
+#    (.inc.json / .phar.json / .php[3-5].json / .php.json.json) plus plain-.json
+#    defacements — an extension allowlist (the old '*.php.json' filter) missed ALL
+#    of them. The robust signal is CONTENT, not extension.
+log "exclude: content-based malware safety net"
+# (a) Any .json under templates/ carrying a PHP open tag is NOT a legit Helix3
+#     layout preset (those are pure JSON) — it is a disguised dropper. This closes
+#     the .json-disguise gap deterministically.
+if [ -d "$OUT/templates" ]; then
+  find "$OUT/templates" -type f -name '*.json' 2>/dev/null | while IFS= read -r j; do
+    if grep -Ilq -m1 -E '<\?php|<\?=' "$j" 2>/dev/null; then
+      log "  drop (php-in-json): ${j#"$OUT"/}"; rm -f "$j"
+    fi
+  done
+fi
+# (b) Legacy extension patterns (belt-and-suspenders; harmless if already gone).
 find "$OUT" \( -name '*.php.json' -o -name '*.phtml.json' -o -name 'h3x_*' -o -name '_h3x_*' \) -delete 2>/dev/null || true
+# (c) Explicit IOC path list (docroot-relative) — the plain-.json defacements,
+#     probe artifacts and non-.json droppers that a content grep cannot key on.
 if [ -f "$ROOT/malware-iocs.paths" ]; then
   while IFS= read -r ioc; do
     [ -z "$ioc" ] && continue
diff --git a/malware-iocs.paths b/malware-iocs.paths
index d223c258..de3be372 100644
--- a/malware-iocs.paths
+++ b/malware-iocs.paths
@@ -19,3 +19,31 @@ components/com_joml_incf
 administrator/components/com_joml_incf
 components/com_sys_rom
 administrator/components/com_sys_rom
+
+# --- 2026 incidens: a vetted-live Helix3-ból behozott, kiterjesztés-álcázott
+#     droppek/defacementek/probe-k + sbtrack cloaking-proxy (security-cleanup).
+#     A PHP-tagos .json droppeket a build-baseline.sh step 6/(a) tartalom-alapon fogja;
+#     az alábbiak (plain-.json defacement/probe + non-.json .php) explicit listán.
+language/en-GB/en-GB.php
+modules/mod_jsnusers/tmpl/index.php
+sbtrack.php
+templates/beez3/info.php
+templates/shaper_helix3/cox.json
+templates/shaper_helix3/layout/5ce342d1feeb3297_xri6l4eq.json
+templates/shaper_helix3/layout/6etar.json
+templates/shaper_helix3/layout/8a38e129e76e80ff_d3h48ag1.json
+templates/shaper_helix3/layout/9cb22468b5254cb4_zaaafntq.json
+templates/shaper_helix3/layout/cox.json
+templates/shaper_helix3/layout/_d1337_vuln_probe.json
+templates/shaper_helix3/layout/dummy.json
+templates/shaper_helix3/layout/_hxep1rur.json
+templates/shaper_helix3/layout/_hxepn2vl.json
+templates/shaper_helix3/layout/_hxepqjbw.json
+templates/shaper_helix3/layout/_hxepqvk3.json
+templates/shaper_helix3/layout/_hxeptiha.json
+templates/shaper_helix3/layout/_hxepx62d.json
+templates/shaper_helix3/layout/_hxprobe8myf1c.json
+templates/shaper_helix3/layout/_hxprobeoa31x6.json
+templates/shaper_helix3/layout/_hxprobet7sh3r.json
+templates/shaper_helix3/layout/jftest.json
+templates/shaper_helix3/layout/nxtest.json