GroupGreeting e-card site attacked in “zqxq” campaign 

Malwarebytes uncovered a widespread JavaScript-injection campaign called "zqxq" that infected GroupGreeting.com and thousands of other high-traffic sites; the obfuscated script performs token generation, environment checks, and remote payload retrieval to redirect visitors to phishing pages or secondary malware, mirroring NDSW/NDSX (TDS Parrot) traffic-distribution behavior and exploiting outdated CMS/plugins and seasonal traffic spikes.