Massive “DollyWay” Malware Attack Compromises 20,000+ WordPress Sites Worldwide

A significant malware operation, dubbed “DollyWay,” has been uncovered by GoDaddy Security researchers, revealing a sophisticated campaign that has compromised over 20,000 WordPress sites globally.

This operation, which began in 2016, leverages a distributed network of compromised WordPress sites as Traffic Direction System (TDS) and Command and Control (C2) nodes.

The malware’s latest iteration, DollyWay v3, employs advanced techniques such as cryptographically signed data transfers, heterogeneous injection methods, and automatic reinfection mechanisms to maintain control over infected sites.

Sophisticated Malware Techniques

DollyWay v3 primarily targets visitors of infected WordPress sites by injecting redirect scripts that funnel traffic through VexTrio, a major cybercriminal affiliate network.

The malware uses a four-stage injection chain to evade detection.

Initially, it appends a dynamically generated script to the site’s main URL, which then loads subsequent scripts that collect referrer information and eventually redirect users to scam pages.

The malware also removes competing malware and updates WordPress to ensure its persistence.

The reinfection mechanism is particularly sophisticated, involving the injection of malicious PHP code into active plugins and WPCode snippets.

According to the Report, this code is re-obfuscated regularly to evade detection, making removal challenging.

Additionally, the malware creates malicious admin users with random hexadecimal usernames and email addresses, further complicating cleanup efforts.

Command and Control Infrastructure

DollyWay maintains its infrastructure through encoded WordPress options, storing settings in a sophisticated format.

The malware updates its node list daily using cryptographic signatures to verify data integrity.

This ensures that only authorized updates are applied, protecting the malware’s control over compromised sites.

The use of compromised WordPress sites as C2/TDS nodes allows the malware to adapt and evolve, making it a formidable threat in the cybersecurity landscape.

The ongoing evolution of DollyWay highlights the increasing sophistication of malware campaigns and the need for robust security measures to protect against such threats.

As the campaign continues to adapt, it remains a significant concern for WordPress site owners and cybersecurity professionals alike.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup – Try for Free

Keep your files stored safely and securely with the SanDisk 2TB Extreme Portable SSD. With over 69,505 ratings and an impressive 4.6 out of 5 stars, this product has been purchased over 8K+ times in the past month. At only $129.99, this Amazon’s Choice product is a must-have for secure file storage.

Help keep private content private with the included password protection featuring 256-bit AES hardware encryption. Order now for just $129.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!