What is the Real Relationship between WordPress Hackers and Malicious Adtech?

An investigation into VexTrio, a malicious traffic distribution system (TDS), revealed surprising connections between WordPress hackers and adtech companies. When VexTrio's operations were disrupted, multiple malware actors migrated to a new TDS that was discovered to be related to VexTrio. Several commercial TDSs were found to share software elements with VexTrio and benefit from its relationship with website malware actors. The investigation uncovered a complex network of adtech firms, including Partners House, BroPush, and RichAds, that use similar technologies and tactics to distribute malicious content. These firms have information about the identities of malware actors, which could potentially lead to their disruption.

• WordPress SEO plugin Rank Math compromised to backdoor websitesMalware2026-10-19
• Rank Math PRO WordPress Plugin Compromised in Supply Chain AttackBreach2026-10-19
• Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution ChainMalware2026-10-25
• WordPress 7.0.2 · Path TravesalExploitedVulnerability2026-10-01
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23