Malicious Virtualizor Update Served via BGP Hijacking

A BGP hijack attack targeted a block of Softaculous IP addresses used for Virtualizor software updates, client area, and billing services. The attacker announced more specific BGP routes, causing traffic to be diverted to their servers. They obtained a valid TLS certificate for Softaculous domains because the domain validation process was also routed through the hijack, allowing them to serve malicious update packages without triggering certificate warnings. Only Virtualizor update clients that checked for updates during the approximately 22-hour hijack window were affected, resulting in a small number of compromised servers. Softaculous confirmed no malicious packages for other products and has restored legitimate routing. The company released Virtualizor version 3.2.9.9 with mitigation tools and is introducing cryptographic package signing to prevent future tampering.

A small number of Virtualizor installations received malicious update packages, potentially compromising those servers. The attack exploited weaknesses in update package verification, as update clients did not cryptographically verify packages. The malicious traffic did not reach Softaculous logs, and no other products were confirmed affected. The incident could lead to unauthorized control or compromise of affected Virtualizor servers. The overall impact is limited due to the small number of affected installations and the short duration of the hijack.

Softaculous has restored legitimate traffic routing and released Virtualizor version 3.2.9.9 containing mitigation tools for known exploits. The company is implementing cryptographic code signing for update packages to prevent tampering. Users should check their Virtualizor installations for compromise, reset client-area passwords, review account activity, and regenerate API keys. Because the affected servers cannot be definitively identified, all Virtualizor operators should assume potential compromise and perform thorough inspections. No further immediate action is required beyond applying the update and following Softaculous’ guidance.