{"id":1920,"date":"2025-04-11T09:47:50","date_gmt":"2025-04-11T09:47:50","guid":{"rendered":"https:\/\/netguide.io\/news\/2025\/04\/11\/dollyway-malware-compromises-20000-wordpress-sites\/"},"modified":"2026-08-26T00:53:53","modified_gmt":"2026-08-26T00:53:53","slug":"dollyway-malware-compromises-20000-wordpress-sites","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/en\/2025\/04\/11\/dollyway-malware-compromises-20000-wordpress-sites\/","title":{"rendered":"DollyWay Malware Compromises 20,000 WordPress Sites Worldwide"},"content":{"rendered":"<div id=\"netgu-773536186\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\">A malware campaign active for years, dubbed \u201cDollyWay,\u201d has compromised more than 20,000 WordPress websites worldwide. The malicious software acts as a large-scale redirection system that funnels visitors of infected sites to fraudulent websites. According to researchers at GoDaddy Security, the campaign has been active since 2016 and has evolved considerably over the years.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Eight Years of Sophisticated Cybercrime<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The current version of the malware, DollyWay v3, uses advanced obfuscation and automatic reinfection techniques to maintain a persistent foothold on compromised websites. While earlier versions of the malware distributed more dangerous payloads such as ransomware or banking trojans, the focus has now shifted to monetization through fraudulent redirects.<\/p><div id=\"netgu-1504540335\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\r\n\r\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\r\n\t\r\n\t\t\t<ul class=\"deals-top__list\">\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ugreen-finetrack-slim-kompatibel-mit-apple-find-my-bluetooth-tracker-karte-bis-zu-7-jahre-batterielebensdauer-100db-piepton-geldboersenfinder-fuer-reisepass\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/41f-DWHa5CL-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">UGREEN FineTrack Slim kompatibel mit Apple Find My | Bluetooth Tracker Karte bis zu 7 Jahre Batterielebensdauer, 100dB Piepton, Geldb\u00f6rsenfinder f\u00fcr Reisepass,\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">19.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>23.98 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-17%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/amazon-kindle-scribe-64-gb-neuartiges-display-mit-gleichmaessigem-rahmen-schreib-einfach-in-buecher-und-dokumente-mit-notizbuchzusammenfassung-mit-premi\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/kindle_shopall_310mmTall-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Amazon Kindle Scribe (64 GB) \u2013 Neuartiges Display mit gleichm\u00e4\u00dfigem Rahmen | Schreib einfach in B\u00fccher und Dokumente | Mit Notizbuchzusammenfassung | Mit Premi\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">329.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>421.02 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-22%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/amazon-de-roborock-saros-20-neo-saugroboter-mit-wischfunktion-36-000-pa-saugkraft-dual-zero-tangle-system-flexiarm-technologie-100c-heisswasser-moppwaesch\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/61jFFBy5YNL._AC_SL1500_-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Amazon.de: roborock Saros 20 Neo Saugroboter mit Wischfunktion, 36.000 Pa Saugkraft | Dual Zero-Tangle-System, FlexiArm Technologie, 100\u00b0C Hei\u00dfwasser-Moppw\u00e4sch\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">899.00 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>999.00 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-10%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/sonos-roam-2-extrem-kompakter-mobiler-wlan-speaker-wasserdicht-10-stunden-akkulaufzeit-schwarz-amazon-de-elektronik-foto\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/31xlTAavNTL-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Sonos Roam 2 Extrem kompakter, mobiler WLAN Speaker \u2013 Wasserdicht \u2013 10 Stunden Akkulaufzeit \u2013 Schwarz : Amazon.de: Elektronik &amp; Foto<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">149.00 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>157.99 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-6%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/philips-hue-white-ambiance-e27-3er-starter-set-inkl-smart-button-dimmbar-alle-weissschattierungen-steuerbar-via-app-kompatibel-mit-amazon-alexa-echo-echo\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/61pZ0xD9KGL._AC_SL1500_-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Philips Hue White Ambiance E27 3er Starter Set inkl. Smart Button, dimmbar, alle Wei\u00dfschattierungen, steuerbar via App, kompatibel mit Amazon Alexa (Echo, Echo\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">77.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>129.99 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-40%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t<\/ul>\r\n\r\n\t\t\t\t\t<p class=\"deals-top__more\">\r\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\r\n\t\t\t<\/p>\r\n\t\t\t<\/aside>\r\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">GoDaddy researchers discovered that seemingly separate malware campaigns are in fact part of a single, large-scale operation. They found identical infrastructure, similar code patterns and matching monetization strategies. The name \u201cDollyWay\u201d comes from a line of code within the malware:&nbsp;<em>define(\u2018DOLLY_WAY\u2019, \u2018World Domination\u2019)<\/em>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Mass Infections Through WordPress Vulnerabilities<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DollyWay v3 exploits known vulnerabilities (\u201cn-day exploits\u201d) in WordPress plugins and themes to compromise websites. According to the researchers, the system generates roughly 10 million fraudulent page views each month. The infected websites redirect visitors to fake dating portals, gambling sites, crypto scam pages and bogus prize offers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Monetization takes place through the affiliate networks&nbsp;<em>VexTrio<\/em>&nbsp;and&nbsp;<em>LosPollos<\/em>. These networks pay the attackers for every successful redirect of users to fraudulent pages.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>A Multi-Stage Infection Chain Provides Cover<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The infection of WordPress websites begins with a script injection. In this step, the WordPress function&nbsp;<em>wp_enqueue_script<\/em>&nbsp;is abused to load an additional malicious script. This script inspects the visitors of the infected website and categorizes them by origin, device type and referrer data. Only certain groups of users are actually redirected to the fraudulent pages:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Visitors without a referrer (direct page views) are not redirected.<\/li>\n\n\n\n<li>Bots or crawlers are detected and blocked (the malware includes a list of 102 known bot user agents).<\/li>\n\n\n\n<li>Logged-in WordPress administrators are not redirected, making the malware harder to detect.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The final redirect is carried out via a Traffic Direction System (TDS) that uses three randomly selected, already-infected websites as nodes. These load hidden JavaScript code that calls up the fraudulent pages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One particularly ingenious trick: the redirect is only triggered once the user clicks on a page element. This prevents passive analysis tools or security software from detecting the malicious redirects during simple page views.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Automatic Reinfection Thwarts Cleanup<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">One of DollyWay\u2019s most persistent traits is its ability to automatically reinfect a cleaned-up site. The malware spreads its code across all active plugins of a WordPress system. In addition, if it is not already present, it installs the&nbsp;<em>WPCode<\/em>&nbsp;plugin, which is normally used for harmless customizations. This plugin, however, is loaded with obfuscated malicious code and deliberately hidden from administrators so that it does not appear in the WordPress interface.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On top of this, the malware creates hidden administrator accounts with random, 32-character names. These can only be tracked down through a direct database inspection and are not visible in the WordPress dashboard.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Protective Measures and Consequences<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">GoDaddy Security has published a list of indicators of compromise (IoCs) to help website operators identify and remove the malware. Experts strongly advise WordPress administrators to apply regular security updates, use only trustworthy plugins and themes, and deploy a Web Application Firewall (WAF) to block potential attack attempts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The DollyWay campaign shows that large-scale, well-organized threats can persist for years if they conceal and evolve themselves cleverly. Website operators should therefore step up their security measures to avoid becoming part of a huge network of fraudulent redirects.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to GoDaddy, further details on the exact infection mechanisms and the infrastructure of the DollyWay malware will be published in a later report.<\/p>\n<div id=\"netgu-2089764887\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>The DollyWay malware campaign has compromised over 20,000 WordPress sites since 2016, redirecting visitors to scam pages via a stealthy TDS.<\/p>\n","protected":false},"author":1,"featured_media":1483,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-1920","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=1920"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1920\/revisions"}],"predecessor-version":[{"id":1937,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1920\/revisions\/1937"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1483"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=1920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=1920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=1920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}