A must-use plugin, often called an mu-plugin, is a WordPress plugin stored in a special directory and loaded automatically on every request. Unlike normal plugins, it does not appear in the standard activation flow and is typically always on unless a defender removes the file from disk.
This makes mu-plugins useful for legitimate site-wide functions, but also attractive to attackers who want persistence. A malicious mu-plugin can run before or alongside normal site code, hide from routine dashboard checks, and keep working even if administrators review the usual Plugins screen. In real defenses, hunting for unexpected files in the mu-plugins directory, comparing them against a filesystem baseline, and reviewing web-server behavior can help expose abuse of this trusted WordPress mechanism.