GoDaddy Annual Cybersecurity Report: 2024 Website Malware Threat Landscape

Summary

In 2024, GoDaddy InfoSec researchers monitored and analyzed website security threats using Sucuri SiteCheck's remote scanning technology, which processed over 70 million website scans across all hosting providers globally. This analysis provides insights into attack patterns and malware campaigns affecting websites worldwide.

The GoDaddy InfoSec malware research team helps protect the broader web ecosystem through automated continuous threat monitoring and detailed analysis, benefiting both our customers and the wider internet community. Our researchers develop and maintain sophisticated detection signatures by analyzing new malware samples, tracking emerging campaigns, and reverse engineering attack methodologies. This proactive approach helps us to identify and block new threats before they can impact our customers. Through collaboration between our malware research and threat intelligence teams along with analysis of malware samples and attack patterns, our security researchers documented sophisticated traffic distribution systems, social engineering tactics, and new methods of malware delivery and persistence.

Analysis of 1.1 million infected websites revealed that malware and malicious redirects dominated the threat landscape, accounting for 74.7% of detected infections. Our researchers saw an increasing number of threat actors using social engineering tactics like fake browser updates and captchas to lure website visitors into installing malware. Additionally, we saw major campaigns including Balada Injector (149,351 detections) and Sign1 (96,084 detections) leveraging traffic distribution systems to monetize compromised website traffic while employing sophisticated visitor profiling to avoid detection.

The abuse of legitimate WordPress plugins and themes continued to be a significant trend, with campaigns storing malicious code in database options rather than files to evade traditional security controls. This technique was particularly evident in the DNS TXT Records campaign, which utilized WPCode to execute malicious PHP code while maintaining persistence through automated reactivation systems. Additionally, the increase in compromises through stolen administrative credentials highlighted the growing connection between endpoint security and website security.

SEO spam techniques continued to evolve, affecting 422,741 websites globally through various methods. Japanese spam (117,393 detections) and gambling-related content (79,817 detections) represented the most prevalent spam categories, employing advanced cloaking techniques and geo-targeting capabilities to maintain effectiveness while avoiding detection.

Key statistics

70.8 million global website scans
1,176,701 infected websites detected with various forms of malicious code and unauthorized modifications
822,651 detections of malware infections and malicious redirects targeting website visitors
422,741 detections of websites compromised with various forms of SEO spam
18,622 detections of credit card stealing malware
16,474 detections of unwanted advertisements
169,163 websites loading resources from domains associated with known malware campaigns

Note: Compromised websites are often infected with one or more of the above categories.

Methodology

Data collection and analysis methodology

Scan coverage:

70.8M scans performed
Period: January 1 - December 31, 2024
Geographic distribution: Global
Platform coverage: All major CMS platforms

This report analyzes data collected through 70.8 million public remote website scans conducted throughout 2024 via Sucuri SiteCheck. Users can request to scan any site by submitting a URL to the tool; therefore, data is not limited to sites that belong to any specific CMS, platform, hosting provider, or country.

The SiteCheck service employs remote scanning technology to analyze websites for security threats and malicious behavior. The scanner operates at the browser level, examining websites as a typical user would experience them.

This approach allows for:

Analysis of client-side source code
Detection of malicious JavaScript injections
Identification of unauthorized redirects
Recognition of defacements and visual modifications
Verification of security headers and configurations

Detection signatures are developed and maintained by GoDaddy InfoSec researchers who regularly analyze new threats and malware campaigns. These signatures enable the identification of specific indicators of compromise across various malware families.

Detection statistics

We broke down these global detection results into five distinct malware families:

Malware and redirects (74.7% of infections)
SEO Spam (38.4% of infections)
Credit card stealers (1.7% of infections)
Unwanted ads (1.5% of infections)
Defacements (0.8% of infections)

The overall infection rate across scanned websites was 1.66%, with malicious code and redirects representing the most common form of compromise.

Emerging patterns and trends

Traffic Distribution Systems

In 2024, traffic brokers like VexTrio were central hubs for malicious redirects. Major campaigns including Balada Injector, Sign1, and DNS TXT redirects routed compromised website traffic through these systems to scam operations. The malicious TDS systems help monetize any visitor regardless of their location, web browser and operating system and at the same time filter out traffic from various bots and security researchers.

Malware campaigns increasingly relied on social engineering tactics to compromise website visitors. Operators for massive campaigns like SocGholish, ClearFake/ClickFix created convincing fake browser update notifications, CAPTCHA challenges, and system repair prompts to deceive users. These tactics proved particularly effective when combined with visitor profiling and geo-targeting, allowing attackers to serve customized lures to specific audiences while avoiding security researchers.

WordPress plugin abuse

Attackers increasingly leveraged legitimate WordPress plugins for malware persistence. DNS TXT Redirects, DollyWay, and Sign1 campaigns utilized plugins like WPCode and WordPress widgets to execute malicious PHP code and inject JavaScript malware. This approach stores malicious code in WordPress databases instead of files, circumventing traditional file-based security controls.

Administrative credential theft

Website compromises through stolen credentials increased as information-stealing malware targeted WordPress and hosting control panel access. Threat actors acquired and monetized these credentials through underground markets, establishing a cycle of system and website compromises.

Magento platform targeting

The CosmicSting vulnerability (CVE-2024-34102) led to widespread compromise of Magento e-commerce platforms. Multiple threat actors exploited this vulnerability to compromise thousands of online stores, resulting in credit card theft and malware distribution.

Cryptocurrency targeting

Q1 2024 saw the emergence of crypto-drainer infections designed to compromise cryptocurrency wallets. While these attacks didn't achieve widespread adoption, they represent continued exploration of new monetization methods by threat actors.

SEO spam

Two primary SEO spam categories dominated in 2024:

Japanese spam campaigns creating extensive networks of doorway pages
Gambling-related content targeting both English-speaking and South-East Asian markets through geo-specific delivery systems

Website infection analysis

In 2024, we used results from the SiteCheck remote scanner to categorize website infections across five distinct malware families. Each family represents different attacker tactics and objectives, from malicious redirects to search engine manipulation.

Let's examine the characteristics and impact of each category.

Malware

Primary category encompassing malicious code injections and organized campaigns.

During 2024, SiteCheck detected 822,651 websites across the internet infected with various forms of malware. The landscape was dominated by several sophisticated campaigns that demonstrated increasing complexity in their attack methodologies.

Balada Injector

The Balada Injector campaign was one of the most prevalent threats in 2024, with 149,351 detected infections on websites hosted by multiple providers. This established campaign is known to inject obfuscated JavaScript code that redirects visitors to various scam sites through a chain of traffic direction systems (TDS), starting with their own TDS and ending with third-party traffic brokers like VexTrio. The malware specifically targets WordPress installations, exploiting vulnerabilities in widely-used plugins.

The infection process follows a systematic approach to establish persistence. Initial compromise may begin with JavaScript injections using cross-site scripting vulnerabilities in WordPress themes and plugins and then proceeding with silently attacking logged in site administrators to add malicious users and counterfeit WordPress plugins that function as backdoors.

The campaign's infrastructure relies on a methodical domain management system. Operators maintain a network of domains constructed using three-word combinations in paired variations (e.g., "cleanreditems"/"cleanblueitems", "brownsisteroftime"/"greensisteroftime"). These domains, often protected behind CDN services, serve different stages of the attack chain and regularly rotate to avoid detection. The malware also employs advanced administration detection, modifying its behavior when it detects logged-in WordPress administrators to facilitate deeper compromise.

*Example of a Balada script injection found on a compromised website.*

Key characteristics of Balada infections include:

Strategic injection points in database options, theme files and common JavaScript files
Multiple layers of code obfuscation that use diverse techniques like obfuscator.io, random comments character code arrays, base64, etc.
Installation of disguised backdoor plugins for persistence
Complex domain infrastructure with recognizable naming patterns
Advanced admin detection for privilege escalation
Integration with push notification scams and traffic distribution systems

SocGholish

Commonly referred to as “fake browser updates”, SocGholish represents one of the more dangerous threats detected in 2024, with 147,332 infections identified across the internet. Active at least since 2017, this malware is responsible for redirecting site visitors to malicious pages designed to trick victims into installing fake browser updates. JavaScript is used to display notices in the victim's web browser and initiate a download for remote access trojans, allowing the attacker to gain full access and remotely control the victim's computer. Attackers are not just infecting websites, they are also leveraging the compromised environments to phish large corporations and employees. The campaign is particularly notorious for its role in ransomware distribution chains, often serving as the initial compromise vector for larger-scale attacks against corporate networks.

The malware typically operates in multiple stages, beginning with an initial JavaScript injection that evaluates visitor characteristics. If a visitor meets the campaign's targeting criteria, the malware presents a convincing browser update notification customized to match the user's actual browser type. This social engineering tactic has proven remarkably effective at convincing users to download and execute the malicious payload.

*Example of a fake Chrome update served by SocGholish malware.*

In 2024, we observed several distinct types of website infections that served SocGholish malware, with NDSW/NDSX (also known as Parrot TDS) remaining the most prevalent. This variant uses both obfuscated code injected into multiple (sometimes all) legitimate JavaScript files and malicious PHP files that serve as a custom PHP proxy system to dynamically obtain the most current SocGholish payload. Both JavaScript and PHP components of this malware feature signature markers such as ndsw, ndsj and ndsx (thus the name of the campaign). However, in April 2024 new variants emerged where the markers changed to zqxw, zqxq and qwzx.

*Example of SocGholish malware seen on infected websites in 2024.*

Another notable campaign served SocGholish to eligible visitors using fake WordPress plugins that injected script tags pointing to Keitaro TDS URLs on their own servers.

*Variations of SocGholish-related injections that use Keitaro TDS.*

SocGholish infection indicators include:

Browser-specific update notifications that match the visitor's exact browser type and language settings
Multi-stage infection chain delivering RATs through fake browser updates
Systematic modification of JavaScript files and custom PHP proxy files in the web environment with NDSW/NDSX variants
Installation of fake WordPress plugins and modification of themes’ function.php files for Keitaro variations
Advanced visitor fingerprinting to target specific user profiles while avoiding security researchers

Sign1

The Sign1 malware campaign emerged as a major threat in 2024, with 96,084 detected infections across the internet. This campaign specifically targets WordPress environments, exploiting legitimate plugins that allow custom code insertion, such as Simple Custom CSS and JS. Once established, Sign1 implements an intricate system of traffic filtering and dynamic payload delivery that effectively evades detection and removal.

A distinctive characteristic of Sign1 is its time-based URL generation and validation mechanism. The malware creates URLs containing hexadecimal timestamps that expire after 10 minutes. When visitors arrive from major platforms like Google or Facebook, the malware validates these timestamps before executing its payload. The execution typically triggers a series of redirects through intermediary domains, ultimately leading visitors to VexTrio scam infrastructure.

The campaign employs multiple evasion techniques, including XOR encoding and dynamic code generation. Rather than modifying server files, Sign1 infections store malicious code in WordPress databases utilizing functionality of legitimate plugins and custom HTML widgets. This approach circumvents standard cleanup procedures and bypasses file-based integrity monitoring systems, making the malware particularly challenging to identify and eliminate.

*Example of a Sign1 malware injection found on an infected WordPress website.*

Key characteristics of Sign1 infections include:

Advanced traffic filtering based on referrer headers from major platforms like Google and Facebook generated time-based URLs that expire within 10-minute windows
Multiple layers of code obfuscation including XOR encoding and dynamic JavaScript generation
Deep integration with VexTrio's traffic distribution system
Use of legitimate WordPress plugins to inject malicious code and store it in a database to evade file-based detection

Bogus URL shorteners

The Bogus URL Shortener campaign, detected on 35,758 websites across the internet in 2024, leverages links resembling URL shortening services to redirect website visitors to low-quality question and answer sites monetized through Google Adsense.

This campaign specifically targets mobile users, creating complex redirect chains that eventually lead to low-quality content farms monetized through aggressive advertising. The attackers have demonstrated remarkable adaptability, regularly introducing new domains and modification techniques to evade detection.

What makes this campaign particularly effective is its multi-faceted approach to code injection. Rather than relying on a single technique, attackers employ various methods ranging from highly obfuscated JavaScript to simple external script tags. In 2023, we observed the campaign expanding its scope to include cryptocurrency-related scams, with compromised sites redirecting mobile traffic to AI-generated blogs about cryptocurrency investments.

The campaign's infrastructure shows significant investment in evasion techniques. Attackers maintain a large network of disposable domains hidden behind DDos-Guard and CloudFlare services/proxies. In 2024, they continued registering bogus URL shortening domains including cuttlyco[.]asia, urlcuttly[.]net, and servme[.]observer.

*Example of bogus URL shortener malware found on an infected website.*

Indicators of compromise include:

Sophisticated traffic filtering targeting mobile devices through extensive user agent analysis
Complex redirect chains implementing multiple intermediate hops to avoid detection and blocking
Continuous rotation of shortener domains through automated infrastructure to maintain campaign resilience
Hybrid injection techniques combining both obvious and deeply obfuscated code to complicate removal

Uncategorized VexTrio redirects

In 2024 SiteCheck found generic uncategorized redirects to VexTrio URLs on 30,191 websites across the internet. Multiple malware campaigns use VexTrio for monetization. The most prominent of them (including Sign1, Balada Injector, and DollyWay) have their own distinct signatures. However, sometimes our SiteCheck scanner can only see generic patterns of VexTrio redirects. This often occurs when the main malicious functionality is hidden on the server side.

VexTrio operates a complex network of redirect chains designed to funnel visitors through various scam operations.

Distinctive features include:

Multi-layer traffic filtering system analyzing user agents, IP addresses, and browser characteristics
Redirects to various scam sites, including:
Browser push notification scams (“Click allow if you are not a robot”)
LosPollos dating and sweepstakes scams
Tech support scams

DNS TXT Records

The DNS TXT Records malware campaign, detected on 24,936 websites across the internet in 2024, represents one of the most innovative approaches to traffic manipulation observed during the year. This campaign distinguishes itself by storing malicious redirect URLs within DNS TXT records of attacker-controlled domains, effectively creating a dynamic, hard-to-detect and block command and control infrastructure. The technique allows attackers to modify their redirect destinations without touching the compromised websites' files or making HTTP requests, making traditional detection methods less effective.

The campaign's evolution throughout 2024 demonstrated increasing complexity, particularly in its shift from client-side JavaScript injections to stealthier server-side PHP redirects in March. This transition significantly improved the malware's ability to evade detection while maintaining its effectiveness. The malware is injected as a WPCode PHP snippet, establishes multiple persistence mechanisms to maintain control even after initial discovery and removal attempts.

The technical implementation reveals careful attention to operational security. The malware employs various evasion techniques, including hiding plugin presence from WordPress admin panels, disguising administrative notifications, and implementing cookie-based backdoors. These backdoors serve multiple purposes, allowing attackers to update DNS tracking domains and create rogue administrator accounts at will. Perhaps most notably, the campaign maintains persistence through automated bot networks that actively monitor and reactivate disabled malicious plugins, making complete removal particularly challenging.

*Typical redirect destination to a DNS TXT Record scam notification.*

Key technical characteristics include:

Sophisticated DNS TXT record query system retrieving encrypted redirect URLs from attacker-controlled domains
Evolution from client-side JavaScript to stealthier server-side PHP implementations for redirect handling
Implementation of persistent backdoors using cookie-based authentication mechanisms
Advanced plugin concealment techniques preventing detection in WordPress administrative interfaces
Automated systems monitoring and reactivating disabled malicious components through bot networks

The campaign primarily leverages domains like tracker-cloud[.]com, ads-promo[.]com, logsmetrics[.]com, tracker-cloud[.]com, cloud-stats[.]com, airlogs[.]net, logs-web[.]com, dns-routing[.]net, cdn-routing[.]com, webdmonitor[.]io for its DNS TXT record infrastructure. Hosting providers are advised to sinkhole DNS queries for these domains and their subdomains to disrupt functionality of the malware.

Web3 crypto drainers

SiteCheck detected Web3 Crypto Drainer malware on 23,372 infected websites across the internet in 2024. This campaign represents a novel form of website malware targeting Web3 and cryptocurrency assets through crypto drainers injected onto compromised websites.

The malware employs phishing tactics, using misleading popups to trick visitors into connecting their cryptocurrency wallets to the compromised site. Once connected, the malware drains funds from the victim's wallet by signing unauthorized transactions that transfer assets to the attacker's wallet.

Historically, drainers have been used on phishing sites designed to attack people interested in cryptocurrencies. These phishing sites were promoted through social networks and instant messaging applications like Telegram.

In 2024, however, bad actors decided that cryptocurrency adoption had improved to a point that made it worthwhile to expose completely unsuspecting visitors of random compromised sites to Web3 scams. In Q1, we saw a number of infections redirecting website visitors to phishing sites containing crypto draining malware. Researchers also saw drainer scripts injected directly into compromised websites.

The most notable malware campaign that injected Angel Drainer scripts used the following URLs:

billlionair[.]app/cachingjs/turboturbo.js
dynamiclinks[.]cfd/cachingjs/turboturbo.js
dynamiclink[.]lol/cachingjs/turboturbo.js
dynamic-linx[.]com/chx.js

*Example of crypto-draining malware found on a compromised website.*

Detections for this malware peaked in February-March 2024 and then gradually died down. It’s likely that the efficacy of crypto drainer scams on compromised sites was significantly lower than those found on specialized phishing sites, so we suspect bad actors needed to wait for the next milestone in Web3 technology adoption.

Characteristics of web3 crypto drainers include:

Targets users of popular cryptocurrency wallets through convincing connection interfaces
Displays “Connect Wallet” pop-ups unrelated to site functionality.
Along with connecting the wallet, users are tricked to give permission to transfer all their digital assets to third-party wallets controlled by the drainer operators.

Web shells

16,978 scans resulted in detection of public web interfaces of known web shells, which are used by bad actors to control and manipulate compromised environments. Using web shells, attackers can perform unauthorized file operations, access and manipulate databases and execute shell commands.