Parrot Traffic Direction System (TDS) is a sophisticated and persistent cybercrime infrastructure used to hijack web traffic from compromised websites and redirect selected visitors to malicious destinations. Active since at least 2019 and publicly reported since October 2021, Parrot TDS has infected tens of thousands of websites worldwide, including those belonging to educational institutions, government agencies, and adult content platforms.
How Does Parrot TDS Work?
Website Compromise and Script Injection
• Attackers gain unauthorized access to legitimate servers—often exploiting weak login credentials or vulnerable plugins in content management systems like WordPress or Joomla.
• Malicious JavaScript code is injected into existing scripts on the compromised server, often using keywords such as ndsj, ndsw, and ndsx to identify different stages of the attack.
Two-Stage Attack Structure
• Landing Script:
The first injected script, known as the “landing script,” profiles each website visitor by collecting information such as IP address, browser details, referrer, and cookies. This profiling helps the TDS filter out bots, security researchers, or unwanted traffic, and identify suitable targets for further exploitation.
• Payload Script:
If the visitor matches the attacker’s criteria, the browser is instructed to fetch a second script—the “payload script.” This script redirects the visitor to a malicious site, phishing page, or initiates a malware download. The payload script is typically identified by the keyword ndsx.
Dynamic and Evasive Operations
• Parrot TDS uses various obfuscation techniques to hide its code and make detection difficult. The scripts often appear well-formatted to avoid suspicion.
• The system dynamically decides which payload to deliver based on the visitor’s profile, making attacks highly targeted and harder to detect.
Campaigns and Impact
• Parrot TDS acts as a gateway for other malicious campaigns, such as FakeUpdate (SocGholish), which may present fake browser update prompts to trick users into downloading remote access tools or other malware.
• The scale is significant: by 2022, over 16,500 websites were infected, and millions of potential victims were at risk.