Loading malware…
Parrot TDS is a malicious traffic direction system used to route visitors from compromised websites into downstream attack chains. It emerged at scale in late 2021 and early 2022, leveraging large numbers of hacked content management system sites, particularly WordPress and Joomla, across sectors including personal, academic, government, and adult-content websites. Its role is to fingerprint visitors and selectively redirect only qualifying targets, making it an enabling component for broader malware delivery operations rather than a conventional endpoint payload family.
Parrot TDS operates by injecting malicious JavaScript into compromised websites and, in some cases, by deploying server-side PHP components on the victim web server. Observed filtering logic evaluates attributes such as IP address, user agent, referrer, and cookies, and commonly limits redirection to a single visit per user to reduce exposure and hinder analysis. Responses are delivered as client-side JavaScript that either suppresses further requests for non-selected users or forwards selected victims into follow-on campaigns. A proxied variant has also been observed using malicious server-side scripts that relay traffic to command-and-control infrastructure while additionally enabling arbitrary code execution on the compromised server, effectively functioning as a backdoor on the web host.
The most prominent downstream campaign associated with Parrot TDS has been FakeUpdate, also known as SocGholish. In those chains, compromised pages are modified to display fraudulent browser update prompts that lead to staged malware delivery. Observed follow-on activity includes victim fingerprinting, execution of PowerShell-based intermediate payloads, and deployment of NetSupport Client as a remote access tool with stealth and persistence mechanisms. Parrot TDS has also appeared in supply-chain-style website compromises involving tampered JavaScript libraries, where injected logic fingerprints browsers and selectively serves malicious content.
Parrot TDS primarily targets website visitors through compromised web infrastructure while also compromising the servers that host the injected content. Its core value to threat operators lies in selective targeting, anti-analysis controls, and scalable redirection into malware or phishing campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
In most cases, a web server compromised by Parrot TDS injects a landing JavaScript code snippet into existing JavaScript files... If conditions set by the landing script are successfully met, the victim’s web browser queries a payload server... The Parrot TDS payload script can direct the victim’s browser to a malicious webpage or other potentially harmful content.
This payload server then returns a JavaScript payload containing keywords such as ndsx... The V2 payload script is straightforward. Without any obfuscation, it creates a new script tag to load JavaScript from a malicious URL.
Scripts with the keyword ndsj use more obfuscation techniques such as Canvas, decodeURI or WebAssembly... Compared to V3, V4 landing scripts contain additional obfuscation... V6 through V9 of the payload script include more obfuscation.
The framework is enabled by four main steps: traffic acquisition, traffic filtering, payload lures, and on-device implant execution.
The landing script conducts environment checks as a way to avoid detection... Parrot TDS landing scripts profile the victim’s web browser... V3 payload scripts will check for the following conditions: A referrer, Acceptable URL format, A platform identifier of “windows”, That Parrot TDS had not previously set a cookie.
The landing script conducts environment checks as a way to avoid detection... Parrot TDS landing scripts profile the victim’s web browser... V3 payload scripts will check for the following conditions: A referrer, Acceptable URL format, A platform identifier of “windows”, That Parrot TDS had not previously set a cookie.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Traffic distribution system used to filter/redirect victims in SocGholish distribution operations (per summary).
Parrot TDS is a traffic distribution system that fingerprints browsers and selectively serves malware to users based on specific criteria, often used in supply chain attacks via compromised web resources.
A large-scale traffic direction system operating through compromised websites and web servers. It filters visitors and redirects selected victims to follow-on malicious campaigns, notably FakeUpdate, and in some cases uses malicious PHP scripts that proxy traffic and provide backdoor-like arbitrary code execution on compromised servers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.