DollyWayMalware
PHP/JavaScript malware for WordPress that injects multi-stage scripts, turning compromised sites into distributed TDS/C2 nodes. Delivers signed payloads, maintains persistence via helper files, and redirects traffic to monetized scam networks.From MISP Galaxy
Last reported 9 days ago, by The Hacker News1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1176.001Browser Extensions
“The destination domains frequently host different scams, such as fake services, malicious browser extensions and more."”
- T1684Social Engineering
“"Help TDS delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to install remote desktop tools," Infoblox said in a report shared with The Hacker News.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams“In all, about 20 different affiliates, including Balada Injector, Detour Dog, and DollyWay, send traffic to Help TDS.”
Indicators in its reports
named in the reports above- roi777[.]comin 1 report
Copy this indicator · defanged
Thanks — we review every report.