Angler Exploit Kit Continues to Evade Detection: Over 90,000 Websites Compromised
Summary: Between November 5 and November 16, Palo Alto Networks' Unit 42 found 90,558 unique domains compromised and used by the Angler Exploit Kit, resolving to 29,531 unique IPs, with one IP (184.168.47.225) hosting 422 compromised sites. When the full list was tested against VirusTotal on December 14, only 2,850 sites were flagged as malicious, a 3% detection rate.
Key Takeaway: More than 90,000 compromised sites - including 40 in the Alexa top 10,000 - were serving Angler's redirects while VirusTotal flagged under 5% of them, and the attackers adapted by cutting off IP ranges after roughly two weeks of scanning and turning injected code on and off to look cleaned up.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026