Threat Actors Compromise 150,000 Websites to Promote Chinese Gambling Platforms

A large-scale cyberattack has compromised approximately 150,000 legitimate websites by injecting malicious JavaScript to redirect visitors to Chinese-language gambling platforms.

The campaign, first detected in February 2025 with 35,000 infected sites, has since expanded significantly, leveraging obfuscated scripts and iframe injections to hijack browsers.

Attackers use domains like zuizhongyj[.]com to host payloads, which display full-screen overlays mimicking legitimate betting sites such as Bet365.

Technical Tactics

The threat actors employ HTML entity encoding and hexadecimal obfuscation to hide malicious scripts, such as injecting