Cybersecurity researchers have uncovered a massive campaign that has infected hundreds of thousands of legitimate websites with malicious JavaScript code, potentially exposing millions of visitors to malware and scams.
## The JSFireTruck Technique
Palo Alto Networks Unit 42 discovered that attackers are using an unusual obfuscation method called JSFuck (renamed JSFireTruck by researchers) to hide malicious code on compromised websites. This technique uses only six special characters—[, ], +, $, {, and }—to write functional JavaScript code, making it extremely difficult to detect and analyze.
Between March 26 and April 25, 2025, researchers identified 269,552 infected web pages. The campaign peaked on April 12, with over 50,000 compromised pages detected in a single day.
## How the Attack Works
The malicious code checks where visitors come from by examining the website referrer. When users arrive from search engines like Google, Bing, DuckDuckGo, Yahoo!, or AOL, they are automatically redirected to malicious websites that can:
– Install malware
– Display fake advertisements
– Monetize traffic illegally
– Deploy system exploits
“The campaign’s scale and stealth pose a significant threat,” researchers noted, suggesting this is a coordinated effort to weaponize legitimate websites.
## The HelloTDS Connection
Gen Digital researchers have also exposed a sophisticated Traffic Distribution Service called HelloTDS that works similarly. This system redirects visitors to various scams including:
– Fake CAPTCHA pages
– Tech support scams
– Bogus browser updates
– Unwanted browser extensions
– Cryptocurrency frauds
HelloTDS uses advanced fingerprinting to profile victims based on their location, IP address, and browser characteristics. The system rejects connections from VPNs or security researchers’ tools, redirecting them to harmless pages instead.
## The ClickFix Strategy
Some attacks employ fake CAPTCHA pages using the “ClickFix” technique, tricking users into manually executing malicious code. This can lead to infection with PEAKLIGHT malware, which then downloads information-stealing programs like Lumma that harvest personal data.
## Infrastructure and Evasion
The attackers use domains with .top, .shop, and .com extensions to host their malicious JavaScript. Their infrastructure employs multi-stage fingerprinting and dynamic domain switching to evade detection while maintaining large-scale operations.
These campaigns demonstrate how cybercriminals continue evolving their methods to bypass security measures, selectively target victims, and operate at unprecedented scales while remaining hidden from traditional detection systems.