VexTrio network hacking sites, spreading malware in stealthy style

In a recent report by researchers, it has been revealed that a network of over 70,000 hijacked websites, known as VexTrio, is being used to distribute malware, serve phishing pages, and engage in other fraudulent activities. The network has been functioning since 2017 or earlier, but details about its operation have only recently emerged. VexTrio operates similarly to traffic distribution systems used in marketing, redirecting visitors to compromised websites to pages that contain malware downloads or fake login screens. At least 60 affiliates are involved in the network, providing compromised websites and receiving a share of the profits from redirecting web traffic. Check Point classified VexTrio as a “considerable” security risk in its January global threat index. One strain of malware pushed via VexTrio, known as SocGholish, was the most prevalent malware in January, affecting four percent of observed organizations worldwide. Another malware, ClearFake, is also pushed via VexTrio. Additionally, ransomware groups such as LockBit3 and 8Base have had a strong start to 2024. However, the reliability of these numbers, which are based on leak sites operated by ransomware groups, is uncertain.