Summary

A recent cross-site scripting (XSS) vulnerability in a virtual tour framework has been exploited by malicious actors to spread malware across hundreds of websites. The campaign, d 360XSS, has affected over 350 sites, with the goal of manipulating search results and fueling a large-scale spam ads campaign.

The attack allows attackers to inject malicious scripts into compromised websites, potentially disrupting user experience and Search Engine Results Page (SERP) rankings. This could have far-reaching consequences for individuals whose websites have been compromised, including reduced visibility and credibility online.

Security researchers are working to address the issue by identifying and patching vulnerable code, as well as implementing mitigations to prevent further exploitation.