{"id":1920,"date":"2025-04-11T09:47:50","date_gmt":"2025-04-11T09:47:50","guid":{"rendered":"https:\/\/netguide.io\/news\/2025\/04\/11\/dollyway-malware-compromises-20000-wordpress-sites\/"},"modified":"2026-08-26T00:53:53","modified_gmt":"2026-08-26T00:53:53","slug":"dollyway-malware-compromises-20000-wordpress-sites","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/en\/2025\/04\/11\/dollyway-malware-compromises-20000-wordpress-sites\/","title":{"rendered":"DollyWay Malware Compromises 20,000 WordPress Sites Worldwide"},"content":{"rendered":"<div id=\"netgu-3624974694\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\">A malware campaign active for years, dubbed \u201cDollyWay,\u201d has compromised more than 20,000 WordPress websites worldwide. The malicious software acts as a large-scale redirection system that funnels visitors of infected sites to fraudulent websites. According to researchers at GoDaddy Security, the campaign has been active since 2016 and has evolved considerably over the years.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Eight Years of Sophisticated Cybercrime<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The current version of the malware, DollyWay v3, uses advanced obfuscation and automatic reinfection techniques to maintain a persistent foothold on compromised websites. While earlier versions of the malware distributed more dangerous payloads such as ransomware or banking trojans, the focus has now shifted to monetization through fraudulent redirects.<\/p><div id=\"netgu-4213062729\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ml2u-226-watch-face-fuer-wearos-im-google-play-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/10\/deal-3-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">ML2U 226 Watch Face f\u00fcr WearOS im Google Play Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>1.39 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/star-citizen-twitch-drops-deko-fuer-den-hangar\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/10\/source-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Star Citizen Twitch Drops \u2013 Deko f\u00fcr den Hangar<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/moon-knight-digital-watch-face-fuer-wear-os-4\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/deal-27-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">MOON KNIGHT Digital Watch Face f\u00fcr Wear OS 4+<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>0.89 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/battlefield-6-code-fuer-spielerkartenhintergrund-und-titel\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/10\/battlefield-6-how-to-redeem-codes-asset-code-9-2026_de-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Battlefield 6 \u2013 Code f\u00fcr Spielerkartenhintergrund und Titel<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/train-sim-world-7-starter-pack-kostenlos-fuer-ps4-ps5-xbox-pc\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/capsule_616x353-11-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Train Sim World 7: Starter Pack kostenlos f\u00fcr PS4, PS5, Xbox, PC<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">GoDaddy researchers discovered that seemingly separate malware campaigns are in fact part of a single, large-scale operation. They found identical infrastructure, similar code patterns and matching monetization strategies. The name \u201cDollyWay\u201d comes from a line of code within the malware:&nbsp;<em>define(\u2018DOLLY_WAY\u2019, \u2018World Domination\u2019)<\/em>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Mass Infections Through WordPress Vulnerabilities<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DollyWay v3 exploits known vulnerabilities (\u201cn-day exploits\u201d) in WordPress plugins and themes to compromise websites. According to the researchers, the system generates roughly 10 million fraudulent page views each month. The infected websites redirect visitors to fake dating portals, gambling sites, crypto scam pages and bogus prize offers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Monetization takes place through the affiliate networks&nbsp;<em>VexTrio<\/em>&nbsp;and&nbsp;<em>LosPollos<\/em>. These networks pay the attackers for every successful redirect of users to fraudulent pages.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>A Multi-Stage Infection Chain Provides Cover<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The infection of WordPress websites begins with a script injection. In this step, the WordPress function&nbsp;<em>wp_enqueue_script<\/em>&nbsp;is abused to load an additional malicious script. This script inspects the visitors of the infected website and categorizes them by origin, device type and referrer data. Only certain groups of users are actually redirected to the fraudulent pages:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Visitors without a referrer (direct page views) are not redirected.<\/li>\n\n\n\n<li>Bots or crawlers are detected and blocked (the malware includes a list of 102 known bot user agents).<\/li>\n\n\n\n<li>Logged-in WordPress administrators are not redirected, making the malware harder to detect.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The final redirect is carried out via a Traffic Direction System (TDS) that uses three randomly selected, already-infected websites as nodes. These load hidden JavaScript code that calls up the fraudulent pages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One particularly ingenious trick: the redirect is only triggered once the user clicks on a page element. This prevents passive analysis tools or security software from detecting the malicious redirects during simple page views.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Automatic Reinfection Thwarts Cleanup<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">One of DollyWay\u2019s most persistent traits is its ability to automatically reinfect a cleaned-up site. The malware spreads its code across all active plugins of a WordPress system. In addition, if it is not already present, it installs the&nbsp;<em>WPCode<\/em>&nbsp;plugin, which is normally used for harmless customizations. This plugin, however, is loaded with obfuscated malicious code and deliberately hidden from administrators so that it does not appear in the WordPress interface.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On top of this, the malware creates hidden administrator accounts with random, 32-character names. These can only be tracked down through a direct database inspection and are not visible in the WordPress dashboard.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Protective Measures and Consequences<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">GoDaddy Security has published a list of indicators of compromise (IoCs) to help website operators identify and remove the malware. Experts strongly advise WordPress administrators to apply regular security updates, use only trustworthy plugins and themes, and deploy a Web Application Firewall (WAF) to block potential attack attempts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The DollyWay campaign shows that large-scale, well-organized threats can persist for years if they conceal and evolve themselves cleverly. Website operators should therefore step up their security measures to avoid becoming part of a huge network of fraudulent redirects.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to GoDaddy, further details on the exact infection mechanisms and the infrastructure of the DollyWay malware will be published in a later report.<\/p>\n<div id=\"netgu-3873507163\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>The DollyWay malware campaign has compromised over 20,000 WordPress sites since 2016, redirecting visitors to scam pages via a stealthy TDS.<\/p>\n","protected":false},"author":1,"featured_media":1483,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_affilinode_tracking":"","_affilinode_autolink_off":false,"_affilinode_rating":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[430],"tags":[],"class_list":["post-1920","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-en"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=1920"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1920\/revisions"}],"predecessor-version":[{"id":1937,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1920\/revisions\/1937"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1483"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=1920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=1920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=1920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}