BadIIS malware hijacks IIS servers to redirect visitors and manipulate search results

BadIIS malware is being used to compromise Microsoft Internet Information Services servers and turn legitimate websites into tools for traffic redirection, SEO fraud, and illicit promotion. The malware runs as a malicious IIS module, letting attackers quietly intercept web requests while the victim site continues to appear normal to administrators and visitors.

A new Cisco Talos report links one BadIIS variant to embedded demo.pdb strings and a developer alias known as lwxat. Talos assesses with moderate confidence that this variant works as a commodity malware tool likely sold or shared across multiple Chinese-speaking cybercrime groups.

The threat matters because BadIIS does not simply deface websites. It can redirect users to gambling, adult content, scam, or other illicit pages, while also feeding search engine crawlers different content to manipulate rankings.

How BadIIS abuses trusted web servers

BadIIS takes advantage of the trust that websites already have with search engines and visitors. Instead of building new spam domains from scratch, attackers compromise existing IIS servers that may already have strong domain reputation and search visibility.

Once installed, the malicious module can inspect incoming traffic and decide what each visitor should see. A normal user may get redirected to a spam site, while a search engine crawler may receive attacker-controlled content designed to poison search results.

Elastic Security Labs reported earlier in 2026 that BadIIS activity had affected more than 1,800 Windows servers in a global SEO poisoning campaign. Those victims included government, corporate, and educational websites across multiple countries.

BadIIS capability	What it does
Traffic redirection	Sends real visitors from legitimate websites to illicit or scam-related destinations.
Search crawler manipulation	Shows different content to crawlers to influence search rankings.
Content hijacking	Injects attacker-controlled titles, descriptions, keywords, and pages.
Backlink injection	Adds internal or external links to support malicious SEO operations.
Persistence tooling	Uses installers, services, and loaders to survive restarts and cleanup attempts.

Cisco Talos found a commodity malware ecosystem

Talos said the demo.pdb variant has been in active development since at least September 2021, with the latest compiled sample dated January 6, 2026. The research also points to rapid updates, feature branching, and evasion work aimed at specific security products.

The Cisco Talos analysis describes a builder tool that lets operators generate configuration files, JavaScript redirectors, PHP backlink scripts, and customized BadIIS binaries. That builder model makes the malware easier to reuse across multiple campaigns.

The lwxat handle appeared in builder artifacts, authentication mechanisms, PDB paths, and live user-agent strings. Talos also found signs of client-specific customization, which supports the view that BadIIS is not just a one-off implant, but part of a broader service-style ecosystem.

BadIIS turns SEO poisoning into a business

BadIIS campaigns often aim to monetize compromised sites through search manipulation rather than direct data theft. Attackers use legitimate servers to rank for popular or illicit search terms, then route visitors toward gambling pages, adult platforms, crypto schemes, or other revenue-generating destinations.

Unit 42 described a related BadIIS SEO poisoning campaign in 2025, where attackers used compromised websites to manipulate search results and control traffic flow. That research also linked the activity to Chinese-speaking actors based on linguistic, infrastructure, and operational evidence.

This makes BadIIS different from malware that focuses only on stealing credentials or encrypting files. The attacker wants the victim server to keep working because the website’s reputation helps generate traffic and revenue.

Why IIS modules are difficult to spot

IIS modules can extend how a Windows web server handles requests, authentication, logging, redirects, compression, and other web functions. That flexibility makes them useful for administrators and developers, but attackers can abuse the same mechanism for stealthy traffic control.

The Microsoft IIS module documentation explains that modules participate in request processing. When a malicious module enters that pipeline, it can act before a visitor sees the final page, which makes simple homepage checks less reliable.

Administrators may not notice the infection if they only browse the website from a corporate network or inspect visible page content. BadIIS can make redirection conditional, based on user agent, language, referrer, search engine source, or other request details.

BadIIS has reached multiple regions

Talos observed attacks using the demo.pdb variant across the Asia-Pacific region, with additional activity in South Africa, Europe, and North America. Earlier research also shows BadIIS campaigns affecting a wide range of organizations, including public-sector and education targets.

The Elastic report said compromised infrastructure appeared in countries including Australia, Bangladesh, Brazil, China, India, Japan, Korea, Lithuania, Nepal, and Vietnam. That spread shows why BadIIS should not be treated as a local or niche web-hosting issue.

The common thread is IIS exposure and website reputation. Any organization running IIS with weak patching, old plugins, poor access controls, or limited server monitoring can become useful infrastructure for a campaign it never intended to join.

What defenders should look for

BadIIS infections can hide behind normal web traffic, so defenders need to inspect the server configuration, not just the public-facing website. Unknown IIS modules, suspicious service names, odd outbound connections, and unexpected redirects all deserve attention.

• Review IIS modules for unknown or recently added entries.
• Check applicationHost.config for unauthorized module registrations.
• Inspect Windows services that impersonate legitimate names such as audio, fax, login, or system services.
• Monitor outbound connections from IIS servers to unusual domains or IP addresses.
• Compare what normal browsers and search engine crawlers receive from the same page.
• Search server files for suspicious redirect scripts, backlink files, and unknown DLLs.
• Keep endpoint and web server protections updated with current BadIIS detections.

The Microsoft IIS guidance can help administrators understand where modules sit in the request pipeline and why unauthorized modules need immediate removal. Server teams should also confirm that only approved administrators can change IIS configuration files.

Why BadIIS cleanup can be tricky

Removing the visible redirect is not enough if persistence components remain on the server. Talos found supporting tools that can reinstall or reload BadIIS after restarts, including service-based installers, droppers, and module initialization components.

That means cleanup should include a full server review. Teams should remove the malicious IIS module, delete related services, check scheduled tasks, review web roots, inspect startup locations, rotate exposed credentials, and investigate how the attacker gained access in the first place.

Organizations should also review search engine results for poisoned pages tied to their domains. A cleaned server may still have indexed spam pages or backlinks that take time to disappear from search results.

BadIIS shows how web compromise has changed

BadIIS highlights a practical shift in cybercrime. Attackers do not always need to steal databases or deploy ransomware to profit from a compromised server. They can turn the server’s reputation, search ranking, and visitor traffic into a revenue channel.

The Unit 42 research also shows how SEO poisoning can support broader operations, including traffic control and follow-on compromise. For defenders, that means a redirect infection should not be dismissed as low impact.

BadIIS turns a trusted website into part of an attacker’s delivery network. IIS administrators should treat unknown modules, crawler-specific content changes, and unexplained outbound traffic as signs of a possible compromise, not just a web configuration issue.

FAQ