Follow Up on Russian Scam

This report documents a campaign of website compromises across multiple hosting providers where attackers inject hidden spam links and upload redirect pages (e.g., under /modules/mod_wdbanners/ and /includes/) to conduct Blackhat SEO, promote online pharmacies, and redirect victims to Russian premium-SMS scams and US “work from home” frauds; the author lists example infected URLs and explains the malicious techniques and user-facing impacts (unexpected SMS charges and fraudulent purchases).