{"id":4656,"date":"2026-09-29T19:40:50","date_gmt":"2026-09-29T19:40:50","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/09\/29\/dollyway-malware-compromisos-20000-sitios-de-wordpress-en-todo-el-mundo\/"},"modified":"2026-09-29T19:40:52","modified_gmt":"2026-09-29T19:40:52","slug":"dollyway-malware-compromisos-20000-sitios-de-wordpress-en-todo-el-mundo","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/es\/2026\/09\/29\/dollyway-malware-compromisos-20000-sitios-de-wordpress-en-todo-el-mundo\/","title":{"rendered":"DollyWay Malware Compromisos 20,000 sitios de WordPress en todo el mundo"},"content":{"rendered":"<div id=\"netgu-2003640763\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\">Una campa\u00f1a de malware activa durante a\u00f1os, llamada \u201cDollyWay\u201d, ha comprometido m\u00e1s de 20.000 sitios web de WordPress en todo el mundo. El software malicioso act\u00faa como un sistema de redirecci\u00f3n a gran escala que embudo a visitantes de sitios infectados a sitios web fraudulentos. Seg\u00fan investigadores de GoDaddy Security, la campa\u00f1a ha estado activa desde 2016 y ha evolucionado considerablemente a lo largo de los a\u00f1os.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Ocho a\u00f1os de cibercrimen sofisticado<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">La versi\u00f3n actual del malware, DollyWay v3, utiliza t\u00e9cnicas avanzadas de obfuscaci\u00f3n y de reinfecci\u00f3n autom\u00e1tica para mantener una posici\u00f3n persistente en sitios web comprometidos. Mientras versiones anteriores del malware distribu\u00edan cargas de pago m\u00e1s peligrosas como ransomware o troyanos bancarios, el foco ahora se ha desplazado a la monetizaci\u00f3n a trav\u00e9s de redirecciones fraudulentas.<\/p><div id=\"netgu-3229403379\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/moon-knight-digital-watch-face-fuer-wear-os-4\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/deal-27-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">MOON KNIGHT Digital Watch Face f\u00fcr Wear OS 4+<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>0.89 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/train-sim-world-7-starter-pack-kostenlos-fuer-ps4-ps5-xbox-pc\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/capsule_616x353-11-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Train Sim World 7: Starter Pack kostenlos f\u00fcr PS4, PS5, Xbox, PC<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ml2u-watchfaces-fuer-wearos-im-google-play-store-2\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844734_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">ML2U Watchfaces f\u00fcr WearOS im Google Play Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>1.39 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenloses-dlc-bundle-fuer-gears-of-war-e-day-liquid-death-bundle\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844571_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenloses DLC-Bundle f\u00fcr Gears of War E-Day \u2013 Liquid Death Bundle<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenlose-emote-im-clash-royale-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/share-image-clashroyale-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenlose Emote im Clash Royale-Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Los investigadores de GoDaddy descubrieron que las campa\u00f1as de malware aparentemente separadas son en realidad parte de una sola operaci\u00f3n a gran escala. Encontraron infraestructura id\u00e9ntica, patrones de c\u00f3digo similares y estrategias de monetizaci\u00f3n coincidentes. El nombre &#8220;DollyWay&#8221; viene de una l\u00ednea de c\u00f3digo dentro del malware:<em>definir(\u2018DOLLY WAY\u2019, \u2018World Domination\u2019)<\/em>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Infecciones de masa a trav\u00e9s de vulnerabilidades de WordPress<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DollyWay v3 explota vulnerabilidades conocidas (\u201cexplotas de d\u00eda\u201d) en plugins de WordPress y temas para comprometer sitios web. Seg\u00fan los investigadores, el sistema genera aproximadamente 10 millones de p\u00e1ginas fraudulentas cada mes. Los sitios web infectados redireccionan a visitantes falsos portales de citas, sitios de juego, p\u00e1ginas de estafa cripto y ofertas de premios falsos.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La monetizaci\u00f3n se realiza a trav\u00e9s de las redes afiliadas<em>VexTrio<\/em>y<em>LosPollos<\/em>. Estas redes pagan a los atacantes por cada exitosa redireccion de usuarios a p\u00e1ginas fraudulentas.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Una cadena de infecci\u00f3n multietapa proporciona cobertura<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">La infecci\u00f3n de sitios web de WordPress comienza con una inyecci\u00f3n de script. En este paso, la funci\u00f3n WordPress<em>wp enqueue script<\/em>es abusado para cargar un script malicioso adicional. Este script inspecciona a los visitantes del sitio web infectado y los clasifica por origen, tipo de dispositivo y datos de referencia. S\u00f3lo algunos grupos de usuarios son realmente redirigidos a las p\u00e1ginas fraudulentas:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>No se redireccionan los visitantes sin un remitente (vistas de p\u00e1gina directa).<\/li>\n\n\n\n<li>Bots o rastreadores son detectados y bloqueados (el malware incluye una lista de 102 agentes conocidos del usuario bot).<\/li>\n\n\n\n<li>Los administradores de WordPress Logged-in no son redireccionados, haciendo el malware m\u00e1s dif\u00edcil de detectar.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">La redireccion final se lleva a cabo a trav\u00e9s de un sistema de direcci\u00f3n de tr\u00e1fico (TDS) que utiliza tres sitios web seleccionados al azar, ya infectados como nodos. Estas cargas ocultan c\u00f3digo JavaScript que llama a las p\u00e1ginas fraudulentas.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Un truco particularmente ingenioso: la redireccion s\u00f3lo se activa una vez que el usuario hace clic en un elemento de p\u00e1gina. Esto evita que las herramientas de an\u00e1lisis pasivos o el software de seguridad detecten las redirecciones maliciosas durante las simples vistas de la p\u00e1gina.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Reinfecci\u00f3n autom\u00e1tica Thwarts Limpieza<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Uno de los rasgos m\u00e1s persistentes de DollyWay es su capacidad de reinfectar autom\u00e1ticamente un sitio limpio. El malware extiende su c\u00f3digo a trav\u00e9s de todos los plugins activos de un sistema de WordPress. Adem\u00e1s, si no est\u00e1 ya presente, instala el<em>WPCode<\/em>plugin, que se utiliza normalmente para personalizaciones inofensivas. Este plugin, sin embargo, est\u00e1 cargado con c\u00f3digo malicioso obfuscado y deliberadamente oculto de los administradores para que no aparezca en la interfaz de WordPress.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Adem\u00e1s de esto, el malware crea cuentas de administrador ocultas con nombres aleatorios de 32 caracteres. Estos s\u00f3lo pueden ser rastreados a trav\u00e9s de una inspecci\u00f3n directa de la base de datos y no son visibles en el panel de WordPress.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Medidas de protecci\u00f3n y consecuencias<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">GoDaddy Security ha publicado una lista de indicadores de compromiso (IoCs) para ayudar a los operadores de sitios web a identificar y eliminar el malware. Los expertos aconsejan firmemente a los administradores de WordPress para aplicar actualizaciones de seguridad regulares, utilizar s\u00f3lo plugins y temas confiables, e implementar un firewall de aplicaciones web (WAF) para bloquear posibles intentos de ataque.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La campa\u00f1a DollyWay muestra que las amenazas a gran escala y bien organizadas pueden persistir durante a\u00f1os si se ocultan y evolucionan inteligentemente. Por lo tanto, los operadores de sitios web deben intensificar sus medidas de seguridad para evitar formar parte de una enorme red de red de red de red de redirecciones fraudulentas.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Seg\u00fan GoDaddy, m\u00e1s detalles sobre los mecanismos exactos de infecci\u00f3n y la infraestructura del malware DollyWay se publicar\u00e1n en un informe posterior.<\/p>\n<div id=\"netgu-3093475934\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>La campa\u00f1a de malware de DollyWay ha comprometido m\u00e1s de 20.000 sitios de WordPress desde 2016, redireccionando a los visitantes a las p\u00e1ginas de estafa a trav\u00e9s de un TDS robo.<\/p>\n","protected":false},"author":1,"featured_media":1483,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-4656","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/4656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=4656"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/4656\/revisions"}],"predecessor-version":[{"id":4657,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/4656\/revisions\/4657"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1483"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=4656"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=4656"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=4656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}