Not sure if this is helpful for investigation, but I noticed one of my rigs' hashrate dropped to zero on WP stats, did a lsof -i and got:

cgminer    5820     user   10u  IPv4 3470164      0t0  TCP GPUMiner001:57242->server.live-chat-studio.com:3333 (ESTABLISHED)

(definitely not WP's IP)

Restarted cgminer and went back to:

cgminer     319     user    4u  IPv4 3543219      0t0  TCP GPUMiner001:51742->192.241.211.125:3333 (ESTABLISHED)

This rig is running BAMT / cgminer 3.7.2

I've been working on another rig that's a clean Ubuntu 13 install with cgminer compiled from source, and so far it's not been affected (AFAIK)

Edit: tell a lie: my other rig that's a clean Ubuntu install was hijacked as well (it was mining DOGE on multipool)