web: embed backdoor