{"id":351,"date":"2024-05-04T10:39:39","date_gmt":"2024-05-04T10:39:39","guid":{"rendered":"https:\/\/elyspace.com\/blog\/?p=351"},"modified":"2024-06-21T09:10:37","modified_gmt":"2024-06-21T09:10:37","slug":"javascript-malware-tactics-tds-server-side","status":"publish","type":"post","link":"https:\/\/elyspace.com\/blog\/javascript-malware-tactics-tds-server-side\/","title":{"rendered":"JavaScript Malware Tactics: TDS, Server-Side Redirects & DNS TXT Records"},"content":{"rendered":"\n

JavaScript Malware Tactics: There’s a new harmful campaign attacking WordPress sites. It added dangerous JavaScript code to these sites, which then sent visitors to harmful VexTrio domains. What’s interesting about this malware is that it used dynamic DNS TXT records from the tracker-cloud[.]com domain to get new redirect URLs.<\/p>\n\n\n\n

\"Image:<\/figure>\n\n\n\n

Since then, we’ve observed how the campaign is changing the way it hides its actions and the domain names it uses to direct traffic.<\/p>\n\n\n\n

In March, there was a major change when the campaign started redirecting traffic through the server instead of the client side.<\/p>\n\n\n\n

In this article, we will explore these recent changes in methods and functions. We will also highlight common signs of a security breach and malicious domains to be cautious of. Plus, we will offer steps to reduce the risk and protect your website and server from these threats.<\/p>\n\n\n\n

\n
\n

Table of Contents<\/p>\nToggle<\/span><\/path><\/svg><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n