Millions at Risk As 'Parrot' Web Server Compromises Take Flight

Unit 42 researchers describe Parrot TDS, an active traffic distribution system that has been compromising thousands of websites since 2021 to inject malicious JavaScript that profiles visitors and redirects them to malware (notably FakeUpdates/SocGholish). The report catalogs payload variants (V1–V9), evasion/obfuscation tactics, IoCs (including ~100 SHA256 hashes and keywords like "ndsx", "ndsw", "ndsj"), likely exploitation of CMS/server vulnerabilities, and recommended mitigations such as server audits, keyword searches for injected files, URL filtering, and next‑generation firewalls.