Loading story…
Researchers reported that Parrot TDS has compromised thousands of websites—primarily servers running WordPress, Joomla, and other CMS platforms—and injected malicious JavaScript that profiles visitors and selectively redirects them to follow-on payloads. Palo Alto Networks said the campaign likely began as early as 2019, earlier than previous public reporting, and has persisted through multiple script revisions with heavier obfuscation while keeping the same basic attack chain. The operation relies on landing scripts commonly tagged with identifiers such as ndsj or ndsw, which fingerprint browsers, evade analysis, and fetch second-stage payload scripts often marked ndsx from attacker-controlled infrastructure.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
Unit 42 published research concluding that Parrot TDS had been active as early as 2019, revising the campaign timeline earlier than prior public reporting. The report detailed persistent use of ndsj, ndsw, and ndsx-tagged JavaScript across evolving landing and payload scripts.
Unit 42 analyzed more than 10,000 Parrot TDS landing scripts collected from August 2019 through October 2023 and identified four major landing-script versions plus nine payload-script versions. The research found the attack chain remained broadly consistent despite increasing obfuscation.
Unit 42 observed that since August 2022, more Parrot TDS landing scripts were injected as multiple lines rather than a single appended line. Researchers assessed this was likely an evasion technique.
Avast published research describing Parrot TDS as a newly identified traffic direction system infecting more than 16,500 websites, primarily poorly secured WordPress and Joomla servers. The report also documented FakeUpdate/SocGholish as the most prevalent downstream campaign and noted a malicious PHP backdoor in the proxied variant.
Between March 1 and March 29, 2022, Avast protected more than 600,000 unique users from visiting infected Parrot TDS sites. Brazil, India, and the United States were among the most affected countries in that period.
Avast identified increased Parrot TDS activity in February 2022 after detecting suspicious JavaScript files on compromised web servers. The campaign was using tens of thousands of compromised websites to redirect visitors into malicious campaigns.
Avast assessed that Parrot TDS had likely been active since October 2021 based on first samples and C2 domain registration dates. This was the earlier public understanding before later research pushed the start date back to 2019.
A Group-IB blog post about Prometheus TDS was published, indicating public reporting on that traffic distribution system by this date. The provided content does not include further event details from the article itself.
Unit 42 found that full Parrot TDS samples were available by August 2019, providing an explicit early anchor for the campaign's presence in the wild.
Unit 42 reported that Parrot TDS samples first appeared as early as 2019, earlier than prior public reporting that placed the campaign's start in 2021. Full Parrot TDS samples were available by August 2019.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourcedecoded.avast.io
Open sourcebleepingcomputer.com
Open sourceblog.group-ib.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that threat actor **TA2726** used a malicious traffic-distribution framework on **1,509 compromised WordPress sites** to turn them into malware delivery gateways. The operation relied on injected fake-plugin JavaScript, `admin-ajax` bootstrapping, and same-origin REST or query endpoints to profile visitors and selectively redirect them based on geography and device type. Eligible Windows users were funneled into **TA569’s SocGholish** fake browser update chain, which led to **GhoLoader** execution, while the broader ecosystem has also routed victims to other payloads including **Lumma Stealer**, **DeerStealer**, **Marcher**, and the macOS stealer **FrigidStealer**. Proofpoint previously identified TA2726 as a malicious traffic distribution service working alongside other actors, including **TA2727**, in web inject campaigns that abuse compromised websites and fake browser update lures across **Windows, Android, and macOS**. In the newer WordPress-focused activity, the observed `s6qgn` implant remained active from April through July 2026 even after disruption efforts against parts of the SocGholish ecosystem, and some infected sites were later repurposed for a separate **ClickFix** injection using **Polygon EtherHiding** smart-contract lookups. The findings indicate a resilient and increasingly collaborative fake-update ecosystem in which shared infrastructure and compromised websites are reused to deliver multiple malware families and complicate attribution.
Jul 22, 2026
Researchers from Confiant, Infoblox, and Netskope reported sustained criminal abuse of traffic distribution systems (TDSs) to filter, cloak, and route victims into scams and malware. Confiant and Infoblox found that attackers have extensively weaponized **Keitaro**, a self-hosted ad-tracking platform, across an ecosystem of roughly **15,500 malicious domains**, including about **9,000** registered specifically for abuse. Their four-month analysis found traffic arriving from programmatic ads, spam, social media, and compromised websites, then being selectively redirected based on device, geography, IP address, and referrer. Investment fraud was the dominant use case, with clusters such as **FaiKast** using deepfake news-style cryptocurrency ads, **WickedWally** targeting U.S. seniors with fake benefits and debt-relief offers, and **FishSteaks** running giveaway scams impersonating consumer brands. Netskope separately documented a parallel TDS-for-hire operation built around more than **12,700** fake CAPTCHA PDF files hosted on Webflow’s CDN and indexed by Google as benign upgrade guides. Those PDFs fed users into a custom **Elixir/Phoenix** routing platform that screened visitors through IP reputation, bot detection, geography, and device checks before sending qualified victims to malware or scam pages and diverting others to ad-arbitrage content. The downstream payloads included **Legion Loader**, a reseller TDS gate linked to `yfdpco` domains, and a Spanish-language premium-SMS fraud scheme. Researchers said the infrastructure has persisted for more than 14 months despite rotating lure domains, underscoring how commercial-style tracking and routing software is being repurposed at scale to industrialize online fraud and malware delivery.
Aug 6, 2026
A large-scale campaign has impersonated popular open-source and freeware projects, including **Ghidra**, **dnSpy**, and **SpiderFoot**, to capture search traffic and hijack software download clicks. Researchers found that the fake sites use CloudFront-hosted JavaScript to intercept a visitor’s first interaction and send users into a gated Traffic Distribution System (TDS) that performs anti-bot screening, VPN and datacenter filtering, click confirmation, and frequency capping before deciding what content to serve. The infrastructure appears primarily built for traffic acquisition and monetization, but selected victims were repeatedly routed into malware delivery chains. Those chains included **SessionGate**, a heavily obfuscated multi-stage framework with strong anti-analysis protections that mainly delivered potentially unwanted applications, as well as **RemusStealer** and **AnimateClipper**, which were used to deploy an infostealer and a cryptocurrency clipper. Researchers said the operation has been active since at least late 2025, with active malware distribution observed from early 2026 and more than **5,000** VirusTotal submissions indicating significant scale.
Jun 29, 2026