# Malicious module and payload delivery

Admin-installed modules hooking the request pipeline, or endpoints serving obfuscated archives and dev files

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; latest 2026-02-11. Updated 2026-11-02._

## How it works
Two assumptions break. First, that code running inside a web server's request pipeline is trusted: an attacker with admin rights installs a native module that hooks every request and decides per-request whether to inject content or redirect [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md). Second, that a legitimate endpoint only returns what its name implies: a compromised WordPress comment endpoint returns XOR-encrypted ZIP archives keyed by the submitted `comment_post_ID`, not comment results [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md). A third shape is packaging: a release tarball ships a dev dependency (`eval-stdin.php`) that evaluates `php://stdin`, which under CGI/FastCGI is the HTTP request body [E3](https://bugbountylibrary.com/r/h1%3A820146.md).

## Where it shows up
- `globalModules`/`modules` entries in `DefaultAppPool.config` or `applicationHost.config` pointing at DLLs not in a known-good baseline [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md)
- Unsigned `ServiceDLL` values under `svchost` and new services with plausible names [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md)
- Comment or form endpoints returning binary, ZIP, or non-HTML bodies, or bodies whose size varies with a posted ID [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md)
- Embedded Base85/Z85 blobs and custom `@font-face` WOFF2 files in otherwise ordinary JS [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md)
- `vendor/` directories in shipped release tarballs containing PHPUnit or other dev-only packages [E3](https://bugbountylibrary.com/r/h1%3A820146.md)
- Response bodies that differ by `User-Agent` or `Referer` (cloaking) [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md)

## How to review
State the invariant and test it: every component that can alter a response must be enumerated and matched to a signed, expected artifact. Diff `globalModules` and module lists against a baseline; flag any unsigned DLL loaded into `w3wp.exe` [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md). For endpoints, the property is that a comment POST returns only comment semantics — inspect content-type, magic bytes, and whether the body changes with `comment_post_ID` [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md). For releases, the property is that shipped artifacts contain no dev dependencies and no file that reads `php://stdin`; check the tarball, not the git tree, and test with URL rewriting both on and off [E3](https://bugbountylibrary.com/r/h1%3A820146.md).

## How finders spotted it
- Observed an intrusion, then followed Defend alerts on a new service and an unsigned `ServiceDLL` to the loader; pivoted on imphash and filename on VirusTotal to find an older, unprotected sample to reverse the full chain [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md)
- Reverse-engineered jQuery-masquerading JS; noticed gibberish filenames rendered as readable text in-browser, traced to an embedded Z85 WOFF2 font with swapped glyph paths, then extracted XOR key logic and C2 from second-stage PowerShell [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md)
- Noticed PHPUnit in the release tarball's `vendor/` dir, recalled the `eval-stdin.php` advisory, and tested whether the file was web-reachable when `index.php` is not rewritten [E3](https://bugbountylibrary.com/r/h1%3A820146.md)

## Variants seen
- Native IIS module hooking the pipeline first and last, with geotargeted config subdomains (kr/vn/cn/...) [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md)
- Abused WordPress comment endpoint serving XOR-keyed encrypted ZIPs with font-obfuscated filenames [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md)
- Dev dependency shipped in a release package, reachable only under certain rewrite configs [E3](https://bugbountylibrary.com/r/h1%3A820146.md)

## Impact and severity
E2 reached 1,800+ interlinked domains, amplifying SEO poisoning and redirecting users to gambling and phishing [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md). E1 led from initial JS to domain controller compromise in as little as 17 hours, ending in DCSync and NTDS.dit dump [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md). E3 was unauthenticated RCE when reachable [E3](https://bugbountylibrary.com/r/h1%3A820146.md). Impact rose with reach (link farms, geotargeting) and with how deep the implant sat in the request path [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md)[E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Microsoft IIS** (request processing pipeline (globalModules/modules in Defaul) (version not stated): BADIIS to the Bone: New Insights to a Global SEO Poisoning Campaign. Report: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md
- **WordPress** (/wp-comments-post.php) (version not stated): Gootloader | Threat Detection Overview. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md
- **Nextcloud**: PHPUnit is included in groupfolders release package potentially causing RCE. Report: https://bugbountylibrary.com/r/h1%3A820146.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gootloader-threat-detection-woff2-obfuscation.md
- E2: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-badiis-to-the-bone-new-insights-to-global-seo-poisoning-campaign.md
- E3: https://bugbountylibrary.com/r/h1%3A820146.md