{"id":4658,"date":"2026-09-29T19:41:05","date_gmt":"2026-09-29T19:41:05","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/09\/29\/dollyway-malware-compromise-20-000-sites-wordpress-dans-le-monde\/"},"modified":"2026-09-29T19:41:07","modified_gmt":"2026-09-29T19:41:07","slug":"dollyway-malware-compromise-20-000-sites-wordpress-dans-le-monde","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/fr\/2026\/09\/29\/dollyway-malware-compromise-20-000-sites-wordpress-dans-le-monde\/","title":{"rendered":"DollyWay Malware compromise 20 000 sites WordPress dans le monde"},"content":{"rendered":"<div id=\"netgu-3231122256\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\">Une campagne de malware active depuis des ann\u00e9es, surnomm\u00e9e &#8220;DollyWay&#8221;, a compromis plus de 20 000 sites WordPress dans le monde entier. Le logiciel malveillant agit comme un syst\u00e8me de redirection \u00e0 grande \u00e9chelle qui entonne les visiteurs des sites infect\u00e9s vers des sites frauduleux. Selon les chercheurs de GoDaddy Security, la campagne est active depuis 2016 et a consid\u00e9rablement \u00e9volu\u00e9 au fil des ans.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Huit ans de cybercriminalit\u00e9 sophistiqu\u00e9e<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">La version actuelle du malware, DollyWay v3, utilise des techniques avanc\u00e9es d&#8217;obfuscation et de r\u00e9infection automatique pour maintenir une position persistante sur les sites Web compromis. Alors que les versions ant\u00e9rieures du malware distribu\u00e9 charges utiles plus dangereuses tels que ransomware ou les Trojans bancaires, l&#8217;attention est maintenant pass\u00e9 \u00e0 la mon\u00e9tisation par des redirections frauduleuses.<\/p><div id=\"netgu-2251276991\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/moon-knight-digital-watch-face-fuer-wear-os-4\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/deal-27-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">MOON KNIGHT Digital Watch Face f\u00fcr Wear OS 4+<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>0.89 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/train-sim-world-7-starter-pack-kostenlos-fuer-ps4-ps5-xbox-pc\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/capsule_616x353-11-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Train Sim World 7: Starter Pack kostenlos f\u00fcr PS4, PS5, Xbox, PC<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ml2u-watchfaces-fuer-wearos-im-google-play-store-2\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844734_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">ML2U Watchfaces f\u00fcr WearOS im Google Play Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>1.39 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenloses-dlc-bundle-fuer-gears-of-war-e-day-liquid-death-bundle\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844571_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenloses DLC-Bundle f\u00fcr Gears of War E-Day \u2013 Liquid Death Bundle<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenlose-emote-im-clash-royale-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/share-image-clashroyale-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenlose Emote im Clash Royale-Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Les chercheurs de GoDaddy ont d\u00e9couvert que les campagnes de malware apparemment s\u00e9par\u00e9es font en fait partie d&#8217;une seule op\u00e9ration \u00e0 grande \u00e9chelle. Ils ont trouv\u00e9 des infrastructures identiques, des mod\u00e8les de code similaires et des strat\u00e9gies de mon\u00e9tisation correspondantes. Le nom \u00abDollyWay\u00bb vient d&#8217;une ligne de code dans le malware:<em>d\u00e9finir(&#8216;DOLLY WAY, \u2018World Domination&#8217;)<\/em>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Infections de masse par les vuln\u00e9rabilit\u00e9s WordPress<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DollyWay v3 exploite des vuln\u00e9rabilit\u00e9s connues (&#8216;n-day exploite&#8217;) dans des plugins WordPress et des th\u00e8mes pour compromettre les sites Web. Selon les chercheurs, le syst\u00e8me g\u00e9n\u00e8re environ 10 millions de pages vues frauduleuses chaque mois. Les sites Web infect\u00e9s rediriger les visiteurs vers de faux portails de rencontres, des sites de jeu, des pages de crypto escroquerie et des offres de faux prix.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La mon\u00e9tisation se fait \u00e0 travers les r\u00e9seaux affili\u00e9s<em>VexTrio<\/em>et<em>LosPollos<\/em>. Ces r\u00e9seaux paient les attaquants pour chaque redirection r\u00e9ussie des utilisateurs vers des pages frauduleuses.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Une cha\u00eene d&#8217;infection multistage offre une couverture<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">L&#8217;infection des sites WordPress commence par une injection de script. Dans cette \u00e9tape, la fonction WordPress<em>wp enquerue script<\/em>est abus\u00e9 pour charger un script malveillant suppl\u00e9mentaire. Ce script inspecte les visiteurs du site infect\u00e9 et les classe par origine, type d&#8217;appareil et donn\u00e9es r\u00e9f\u00e9rentes. Seuls certains groupes d&#8217;utilisateurs sont effectivement redirig\u00e9s vers les pages frauduleuses:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Les visiteurs sans r\u00e9f\u00e9rence (vues directes de page) ne sont pas redirig\u00e9s.<\/li>\n\n\n\n<li>Les bots ou les rampeurs sont d\u00e9tect\u00e9s et bloqu\u00e9s (le malware inclut une liste de 102 agents utilisateurs de bots connus).<\/li>\n\n\n\n<li>Logged-in administrateurs WordPress ne sont pas redirig\u00e9s, rendant le malware plus difficile \u00e0 d\u00e9tecter.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">La redirection finale est effectu\u00e9e via un syst\u00e8me de direction du trafic (TDS) qui utilise trois sites Web choisis au hasard, d\u00e9j\u00e0 infect\u00e9s comme n\u0153uds. Ils chargent le code JavaScript cach\u00e9 qui appelle les pages frauduleuses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Une astuce particuli\u00e8rement ing\u00e9nieuse : la redirection n&#8217;est d\u00e9clench\u00e9e qu&#8217;une fois que l&#8217;utilisateur clique sur un \u00e9l\u00e9ment de page. Cela emp\u00eache les outils d&#8217;analyse passive ou le logiciel de s\u00e9curit\u00e9 de d\u00e9tecter les redirections malveillantes lors de simples vues de page.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Nettoyage automatique de la r\u00e9infection Thwarts<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">L&#8217;un des traits les plus persistants de DollyWay est sa capacit\u00e9 \u00e0 r\u00e9infecter automatiquement un site nettoy\u00e9. Le malware diffuse son code sur tous les plugins actifs d&#8217;un syst\u00e8me WordPress. En outre, s&#8217;il n&#8217;est pas d\u00e9j\u00e0 pr\u00e9sent, il installe le<em>Code WP<\/em>plugin, qui est normalement utilis\u00e9 pour les personnalisations inoffensives. Ce plugin, cependant, est charg\u00e9 de code malveillant obfusqu\u00e9 et d\u00e9lib\u00e9r\u00e9ment cach\u00e9 aux administrateurs de sorte qu&#8217;il n&#8217;appara\u00eet pas dans l&#8217;interface WordPress.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">En plus de cela, le malware cr\u00e9e des comptes d&#8217;administrateur cach\u00e9s avec des noms al\u00e9atoires de 32 caract\u00e8res. Ceux-ci ne peuvent \u00eatre suivis que par une inspection directe de la base de donn\u00e9es et ne sont pas visibles dans le tableau de bord WordPress.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Mesures de protection et cons\u00e9quences<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">GoDaddy Security a publi\u00e9 une liste d&#8217;indicateurs de compromis (IoCs) pour aider les op\u00e9rateurs de sites Web \u00e0 identifier et supprimer le malware. Les experts conseillent fortement aux administrateurs WordPress d&#8217;appliquer des mises \u00e0 jour de s\u00e9curit\u00e9 r\u00e9guli\u00e8res, d&#8217;utiliser uniquement des plugins et des th\u00e8mes dignes de confiance, et de d\u00e9ployer un Pare-feu d&#8217;application Web (WAF) pour bloquer les tentatives d&#8217;attaque potentielles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La campagne DollyWay montre que les menaces \u00e0 grande \u00e9chelle et bien organis\u00e9es peuvent persister pendant des ann\u00e9es si elles se cachent et \u00e9voluent habilement. Les op\u00e9rateurs de sites Web devraient donc renforcer leurs mesures de s\u00e9curit\u00e9 afin d&#8217;\u00e9viter de faire partie d&#8217;un vaste r\u00e9seau de redirections frauduleuses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Selon GoDaddy, d&#8217;autres d\u00e9tails sur les m\u00e9canismes d&#8217;infection exacts et l&#8217;infrastructure du malware DollyWay seront publi\u00e9s dans un rapport ult\u00e9rieur.<\/p>\n<div id=\"netgu-3668953118\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>La campagne de malware DollyWay a compromis plus de 20 000 sites WordPress depuis 2016, rediriger les visiteurs vers des pages d&#8217;escroquerie via un TDS furtif.<\/p>\n","protected":false},"author":1,"featured_media":1483,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-4658","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/4658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=4658"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/4658\/revisions"}],"predecessor-version":[{"id":4659,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/4658\/revisions\/4659"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1483"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=4658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=4658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=4658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}