Over 1,800 Windows Servers Compromised by BADIIS Malware in Large-Scale SEO Poisoning Campaign

A sophisticated global SEO-poisoning campaign using the BADIIS malware has compromised over 1,800 Windows IIS servers across government, education, and financial sectors; BADIIS installs as a native IIS module, inspects User-Agent headers to serve injected SEO content to crawlers while showing clean pages to users, and uses direct system calls to evade EDR, with Elastic Security Labs attributing the activity to threat group UAT-8099.