Tag: m0yv

1 Attack Reports | 0 Vulnerabilities

Attack reports

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

A malware campaign called WEBJACK is compromising Microsoft IIS servers to deploy BadIIS malware modules for SEO poisoning and fraud. The attackers hijack high-profile targets, including government and educational institutions, to redirect users to gambling websites. The campaign uses various tools…
seo poisoning
cobalt strike
chinese threat actor
latin america
southeast asia
badiis
iis modules
2025-11-19
xlanyloader
iis hijacking
m0yv
gambling redirection
Published: November 19, 2025
Downloadable IOCs: 34
Click here to see more Attack Reports