Over 20,000 WordPress Sites Infected by DollyWay Malware: How to Protect Your Website

A large-scale malware campaign called DollyWay has compromised more than 20,000 WordPress websites, redirecting users to fraudulent gambling, crypto, and sweepstakes sites. This persistent malware is challenging to detect and remove, making it a major threat to website owners.

Hacked WordPress website with malware warnings, glitch effects, and scam pop-ups, symbolizing a cyberattack.

🛡️ What is DollyWay Malware?

DollyWay has been active since 2016 and is responsible for generating 10 million impressions per month, making it a lucrative tool for cybercriminals. The malware exploits vulnerabilities in outdated WordPress plugins and themes, injecting malicious code that redirects visitors to scam websites.

🔍 How It Evades Detection:

• DollyWay activates redirections only when visitors click on something, bypassing security tools that scan for automatic redirects.

• It avoids detection by excluding logged-in users, bots, and direct visitors from being redirected, making it harder to identify.

  
  

🔒 How to Protect Your WordPress Site

✅ 1. Keep Plugins and Themes Updated:

• Hackers often exploit outdated components with known vulnerabilities.

• Regularly update your WordPress core, themes, and plugins to patch security flaws.

🔐 2. Use Security Plugins and Monitoring Tools:

• Install robust security tools like Wordfence, Sucuri, or iThemes Security.

• These plugins offer firewalls, malware scanning, and real-time threat monitoring.

🔑 3. Strengthen Access Controls:

• Use strong, unique passwords and enforce two-factor authentication (2FA) for admin accounts.

• Limit access to only trusted administrators.

💾 4. Perform Regular Backups:

• Schedule frequent backups of your entire website.

• In case of an infection, you can quickly restore a clean version without losing critical data.

🛠️ 5. Scan for Malware and Remove Infections:

• Regularly scan your site for malicious scripts using security tools.

• If infected, follow WordPress security guides or seek professional help to remove the malware.

  
  

🚫 Final Takeaway

With DollyWay’s sophisticated tactics, proactive security measures are essential to safeguard your WordPress site. Regular updates, security plugins, and strong access controls can significantly reduce the risk of infection, protecting both your website and visitors from falling victim to cybercriminal schemes.