150,000 Websites Hijacked by JavaScript Injection: How Hackers Are Promoting Chinese Gambling Sites

Imagine visiting a trusted website, only to be redirected to an unexpected Chinese gambling platform. This is the reality for 150,000+ compromised websites, where cybercriminals have injected malicious JavaScript to hijack user sessions and promote illicit gambling sites.

This campaign, which continues to evolve, highlights the rising threat of client-side attacks that exploit vulnerable websites to redirect users without their knowledge. Let’s break down how this attack works and what website owners can do to defend against it.Attack Chain Breakdown

Hackers inject malicious JavaScript into compromised websites, which allows them to:

According to c/side security analyst Himanshu Anand, as of now, 135,800+ infected websites contain the JavaScript payload, which is hosted on multiple attacker-controlled domains (e.g., zuizhongyj[.]com).

Once a user visits an infected site, the malicious script executes an iframe injection that loads a full-screen overlay mimicking a legitimate betting platform like Bet365.

This deception is achieved using:

🎭 CSS tricks to hide the real website
🎭 Official logos and branding to impersonate well-known gambling sites

The goal? Make the user believe they are interacting with a real platform, tricking them into signing up, depositing money, or providing personal details.