A malware campaign active for years, dubbed “DollyWay,” has compromised more than 20,000 WordPress websites worldwide. The malicious software acts as a large-scale redirection system that funnels visitors of infected sites to fraudulent websites. According to researchers at GoDaddy Security, the campaign has been active since 2016 and has evolved considerably over the years.
Eight Years of Sophisticated Cybercrime
The current version of the malware, DollyWay v3, uses advanced obfuscation and automatic reinfection techniques to maintain a persistent foothold on compromised websites. While earlier versions of the malware distributed more dangerous payloads such as ransomware or banking trojans, the focus has now shifted to monetization through fraudulent redirects.
GoDaddy researchers discovered that seemingly separate malware campaigns are in fact part of a single, large-scale operation. They found identical infrastructure, similar code patterns and matching monetization strategies. The name “DollyWay” comes from a line of code within the malware: define(‘DOLLY_WAY’, ‘World Domination’).
Mass Infections Through WordPress Vulnerabilities
DollyWay v3 exploits known vulnerabilities (“n-day exploits”) in WordPress plugins and themes to compromise websites. According to the researchers, the system generates roughly 10 million fraudulent page views each month. The infected websites redirect visitors to fake dating portals, gambling sites, crypto scam pages and bogus prize offers.
Monetization takes place through the affiliate networks VexTrio and LosPollos. These networks pay the attackers for every successful redirect of users to fraudulent pages.
A Multi-Stage Infection Chain Provides Cover
The infection of WordPress websites begins with a script injection. In this step, the WordPress function wp_enqueue_script is abused to load an additional malicious script. This script inspects the visitors of the infected website and categorizes them by origin, device type and referrer data. Only certain groups of users are actually redirected to the fraudulent pages:
- Visitors without a referrer (direct page views) are not redirected.
- Bots or crawlers are detected and blocked (the malware includes a list of 102 known bot user agents).
- Logged-in WordPress administrators are not redirected, making the malware harder to detect.
The final redirect is carried out via a Traffic Direction System (TDS) that uses three randomly selected, already-infected websites as nodes. These load hidden JavaScript code that calls up the fraudulent pages.
One particularly ingenious trick: the redirect is only triggered once the user clicks on a page element. This prevents passive analysis tools or security software from detecting the malicious redirects during simple page views.
Automatic Reinfection Thwarts Cleanup
One of DollyWay’s most persistent traits is its ability to automatically reinfect a cleaned-up site. The malware spreads its code across all active plugins of a WordPress system. In addition, if it is not already present, it installs the WPCode plugin, which is normally used for harmless customizations. This plugin, however, is loaded with obfuscated malicious code and deliberately hidden from administrators so that it does not appear in the WordPress interface.
On top of this, the malware creates hidden administrator accounts with random, 32-character names. These can only be tracked down through a direct database inspection and are not visible in the WordPress dashboard.
Protective Measures and Consequences
GoDaddy Security has published a list of indicators of compromise (IoCs) to help website operators identify and remove the malware. Experts strongly advise WordPress administrators to apply regular security updates, use only trustworthy plugins and themes, and deploy a Web Application Firewall (WAF) to block potential attack attempts.
The DollyWay campaign shows that large-scale, well-organized threats can persist for years if they conceal and evolve themselves cleverly. Website operators should therefore step up their security measures to avoid becoming part of a huge network of fraudulent redirects.
According to GoDaddy, further details on the exact infection mechanisms and the infrastructure of the DollyWay malware will be published in a later report.
