SYMBOLCOMMON_NAMEaka. SYNONYMS
php.dollyway (Back to overview)

DollyWay

PHP/JavaScript malware for WordPress that injects multi-stage scripts, turning compromised sites into distributed TDS/C2 nodes. Delivers signed payloads, maintains persistence via helper files, and redirects traffic to monetized scam networks.

References
2025-06-12 ⋅ Infoblox ⋅ Infoblox Threat Intelligence Group
Vexing and Vicious: The Eerie Relationship between WordPress Hackers and an Adtech Cabal
DollyWay
2025-03-25 ⋅ GoDaddy ⋅ Denis Sinegubko
Inside DollyWay’s C2 Infrastructure: Traffic Direction Systems and the LosPollos Connection
DollyWay
2025-03-17 ⋅ GoDaddy ⋅ Denis Sinegubko
DollyWay World Domination: Eight Years of Evolving Website Malware Campaigns
DollyWay

There is no Yara-Signature yet.