Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Parrot TDS: A Persistent and Evolving Malware Campaign

Summary: Unit 42 reported that Parrot TDS, a traffic direction system active since at least 2019 by its data, injects JavaScript into compromised web servers: a landing script (keywords ndsj or ndsw) profiles the victim's browser and, if checks pass, fetches a payload script (keyword ndsx) that can redirect the browser to malicious content. From more than 10,000 landing scripts collected between August 2019 and October 2023, researchers identified four major landing script versions covering about 95.8% of samples and nine payload script versions, with V2 payloads making up more than 70%.

Bottom line: The campaign has run more than four years and compromised sites across industries, nationalities and regions, mostly on WordPress or Joomla, with attackers likely using automated tools against known vulnerabilities - so your CMS estate is the exposure surface, and the detection method is a file search for ndsj, ndsw and ndsx.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026