Online casino SEO spam has surged since 2021, with attackers increasingly compromising WordPress sites to inject cloaked casino pages and backlinks, often targeting regions with strict gambling laws like Indonesia. The observed infection used layered redundancies—database-stored payloads, .dat files, theme/plugin modifications, and reinfection code—to persist and evade detection. #SlotGacor #browsec.xyz
Keypoints
- Online casino spam has become the most common form of blackhat SEO spam detected by the SiteCheck scanner since 2021, surpassing previous leaders like Japanese SEO spam.
- Attackers commonly hack WordPress sites to inject hidden backlinks or replace existing pages (e.g., About) with spam directories to capture preexisting traffic and SEO value.
- The investigated infection used cloaking: payloads were served only for specific paths (e.g., “programs”) and could be fetched from an attacker-controlled domain (browsec[.]xyz) or pulled from the database.
- Payload storage and execution employed multiple locations and formats: a wp_option (wp_footers_logic), a cache file (wp-content/cache/style.dat), and injected code in theme (functions.php) and plugin files.
- Redundancy and reinfection mechanisms were implemented: identical code in multiple files, fallback fetching from a remote domain, and a reinfection routine that appends malicious code back if markers are missing.
- Attackers used non-standard storage (database option and .dat file) and lightweight footprint in .php to evade many security scanners that skip databases or certain file types.
- Spam campaigns are targeted at international audiences (notably Indonesia, Thailand, Turkey) where gambling is restricted, increasing the attractiveness of online casinos as spam content.
MITRE Techniques
- [T1505] Server Software Component – Attackers added malicious code to WordPress theme and plugin files (functions.php and ./wp-content/plugins/astra-addon/astra-addon.php) to execute spam payloads and maintain persistence. Quote: ‘buried at the bottom of their theme’s functions.php file was some questionable code’
- [T1505.003] Web Shell – Malicious code allowed remote fetching and execution of spam content from browsec[.]xyz and persisted as a database option and .dat file to render content. Quote: ‘the content is fetched from the browsec[.]xyz domain, and then re-inserted into the database using update_option’
- [T1560] Archive Collected Data (storage/use of non-standard files) – Payloads stored in non-standard file extension (style.dat) within wp-content/cache to evade scanners that ignore certain extensions. Quote: ‘write it to wp-content/cache/style.dat and include-ing it as a fallback’
- [T1055] Process Injection (eval execution) – The decoded payload from the database was executed via eval(), with fallback inclusion if eval() was disabled. Quote: ‘it will execute the decoded payload by eval()… If eval() is disabled… it will write it to wp-content/cache/style.dat and include-ing it as a fallback.’
- [T1499] Endpoint Denial of Service / Resource Hijacking (SEO abuse) – Hijacking existing website pages and adding spam directories to capture search engine and visitor traffic for blackhat SEO purposes. Quote: ‘create a new directory within the website structure with the same “about” name and place an index.html file full of spam links within it’
- [T1609] Active Scanning (recon via Whois/domain reuse) – Attackers used a recently registered browsec[.]xyz domain mimicking a legitimate service to host payloads and obfuscate attribution. Quote: ‘the .xyz bogus domain was registered just a few months ago… low-effort attempt at feigning innocence’
Indicators of Compromise
- [Domain ] attacker-controlled payload hosting – browsec[.]xyz (hosts Slot Gacor spam content and payloads)
- [File path / filename ] injected theme/plugin files and cache – wp-content/themes/…/functions.php, ./wp-content/plugins/astra-addon/astra-addon.php, wp-content/cache/style.dat
- [Database option ] malicious stored payload – wp_option named wp_footers_logic containing base64-encoded spam HTML
- [URL path ] cloaked spam trigger – requests to path “programs” returned spam content while other pages remained normal
Read more: https://blog.sucuri.net/2025/11/slot-gacor-the-rise-of-online-casino-spam.html