Word Press Sites Turned Weapon: How Vex Trio and Affiliates Run a Global Scam Network
Summary: Infoblox has linked the VexTrio Viper traffic distribution service to other TDS operations including Help TDS and Disposable TDS, with malicious adtech companies such as Los Pollos, Taco Loco, and Adtrafico running a commercial affiliate network that connects malware actors to advertising affiliates. The operation relies on compromised WordPress sites injected with code like Balada, DollyWay, Sign1, and DNS TXT record campaigns to redirect visitors to scam infrastructure, and Infoblox's analysis of 4.5 million DNS TXT record responses over six months found two domain sets with separate command-and-control servers hosted in Russian-connected infrastructure.
Why it matters: Hundreds of thousands of compromised websites worldwide redirect victims into VexTrio and its affiliate TDSs each year, and the operators hold enough information to identify the malware actors behind those sites.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026