Sr. Malware Research Mgr @ GoDaddy / Sucuri Inc. | Web Malware Analysis | Reverse Eng | Passionate about protecting the Web | Tweets and Thoughts are my own
Arizona, USA
Joined June 2010
- Tweets1.6K
- Following914
- Followers796
- Likes2.4K
Rodrigo Escobar retweeted
GoDaddy Security researchers detail the evolution of Help TDS. The malicious woocommerce_inputs WordPress plugin, developed between late 2024 & June 2025 and incorporating credential harvesting, geo-filtering & advanced evasion, is installed on 10k+ sites. godaddy.com/resources/news/h…
Rodrigo Escobar retweeted
The malicious woocommerce_inputs WordPress plugin is tightly integrated with HelpTDS (known for tech support scams), utilizing its C2 servers (t[.]me/s/trafficredirect and pinkfels[.]shop) for geo-targeting, credential exfiltration, and automatic updates. godaddy.com/resources/news/h…
Rodrigo Escobar retweeted
Our analysis of 70.8 million global website scans in 2024:
Top website malware: Balada Injector, SocGholish, Japanese SEO spam.
Top trend: Fake browser updates and captchas.
New threat: Web3 cryptodrainers on compromised sites.
Rodrigo Escobar retweeted
At GoDaddy, our security efforts are geared not only to help protect our customers — but also to benefit the wider internet community.
Our Website Malware Threat Report summarizes common malware threats seen in the past year — from traffic systems to social engineering.
Rodrigo Escobar retweeted
Wrapping up the series of posts about the "DollyWay World Domination" malware operation. This time documenting the timeline and evolution from Master134 in 2016 to the current DollyWay v3.
godaddy.com/resources/news/d…
Part 2 of the amazing research performed by @unmaskparasites. DollyWay malware operation
Inside the DollyWay malware operation:
In part II of the series, security researcher @unmaskparasites explores the DollyWay campaign's distributed C2/TDS nodes, revealing redirect partners and campaign statistics. godaddy.com/resources/news/d…
Rodrigo Escobar retweeted
In this second follow-up post about the DollyWay malware operation, I explore the distributed DollyWay TDS/C2 nodes: architecture, redirect partners, statistics and estimated reach of the campaign
godaddy.com/resources/news/d…
Another amazing research from @unmaskparasites
The first of 3 in our series of posts about the “DollyWay World Domination” malware operation.
The most recent campaign: DollyWay v3. 10,000+ infected sites that redirect visitors to VexTrio and tech support scam sites.
godaddy.com/resources/news/d…
Rodrigo Escobar retweeted
Since the end of September ClickFix fake plugins started using .js that loads the ethers lib from CloudFlare instead of cdn.ethers.io. Thus a new hash urlscan.io/search/#hash%3A52…
Re: godaddy.com/resources/news/t…
Rodrigo Escobar retweeted
My research on swarms of fake WordPress plugins used to inject ClickFix fake browser update malware into thousands of websites worldwide.
This time publishing on GoDaddy Engineering blog:
godaddy.com/resources/news/t…
Very interesting post from our Malware Research Team, kudos to @unmaskparasites
godaddy.com/resources/news/t…
Rodrigo Escobar retweeted
Nice post by @_jamsec
publicwww.com/websites/%22Cl…
Sucuri SiteCheck detects this malware as malware?fake_update.7
Don't fall for fake popups! Our latest post breaks down how WordPress sites are being used to distribute ClearFake trojan malware. Learn more in our detailed analysis. #CyberSecurity #WordPressSecurity #DigitalThreats
bit.ly/3WZiJhT
Rodrigo Escobar retweeted
Malwoverview 6.0.0 has been released:
github.com/alexandreborges/m…
All the work was done by the new contributor, my colleague Artur Marzano (@MacmodSec), who deserves all the credit, he put in a lot of effort and dedicated his time to the project. For my part, I only helped Artur with the edge cases and in evaluating all the changes.
This new version is a complete refactoring of the project, where each endpoint is in a separate module. In addition, the code is cleaner and without duplication, making it easier for other professionals to contribute.
To install the new version 6.0.0:
$ python -m pip install -U malwoverview
Additional information is available on the GitHub.
#malware #threathunting #threatinformation #infosec #informationsecurity #dfir
Rodrigo Escobar retweeted
SocGholish operates through a series of deceptive and sophisticated tactics designed to trick users and evade detection.
Learn about the most common indicators of compromise and mitigation steps to protect your site.
#SocGholish #malware
sucur.it/4epUlh9
Rodrigo Escobar retweeted
It's here: Sucuri's 2023 Hacked Website & Malware Threat Report.
Discover the latest trends and stats for website malware and compromised websites.
Kudos to our malware research team for their hard work and invaluable insights!
Rodrigo Escobar retweeted
It has been 15 years since the domain sucuri.net was registered, back on Apr 24, 2009.
Today we're saying "Happy 15th Birthday, Sucuri!" and thanks to all our amazing customers! #Sucuri15Years
Here is to another amazing 15 years and more!: sucur.it/2IFKU1w
Rodrigo Escobar retweeted
Incident Response has identified a fresh wave of SocGholish infections targeting #WordPress websites. Infected sites are found using legit WP plugins that have been tampered with to deliver SocGholish payloads. Research by @_jamsec.
sucur.it/3IlQyme
#SocGholish #Malware
Rodrigo Escobar retweeted
SocGholish scripts injected at the bottom of functions.php files of WordPress themes:
urlscan.io/search/#ficinity.…
urlscan.io/search/#iredelltx…
urlscan.io/search/#acuiplast…
urlscan.io/search/#binder-sa…
