WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization
Essential information
- Published
- 19/11/2025 09:01
- Modified
- 19/11/2025 09:34
- Tags
- 2025-11-19 badiis chinese threat actor cobalt strike gambling redirection iis hijacking iis modules latin america m0yv seo poisoning southeast asia xlanyloader
- Related entities
- 34 observables, 1 intrusion sets (apt), 11 techniques (mitre), 4 malware, 4 others
Description
A malware campaign called WEBJACK is compromising Microsoft IIS servers to deploy BadIIS malware modules for SEO poisoning and fraud. The attackers hijack high-profile targets, including government and educational institutions, to redirect users to gambling websites. The campaign uses various tools from the Chinese cybercriminal ecosystem, suggesting a Chinese-speaking threat actor. The malicious IIS modules selectively serve content to search engine crawlers while redirecting or blocking ordinary visitors. The operation spans multiple countries, primarily in Southeast Asia and Latin America, with a focus on Vietnamese-language targeting. The campaign demonstrates the evolving nature of IIS hijacking and the growing trend of leveraging legitimate security tools for malicious purposes.