TrackMyPoss affiliate fraud kit

The name predates the current loader

Sucuri documented /* trackmyposs*/ in a 2022 WordPress campaign that appended obfuscated JavaScript to jquery.min.js, jquery-migrate.min.js and the database. The decoded injection added a remote script and redirected visitors through advertising pages (Sucuri). We use TrackMyPoss for the controller lineage that keeps the same job: load from a compromised page, ask a server what to do and run its answer.

The current WordPress injection adds a deferred external script with the handle ic-tracker-js and a ten-digit ?ts= value. WP Rocket and WP Meteor can move its address into data-rocket-src or data-wpmeteor-src. Many pages add a second tag, wp-core-js, with the same timestamp. That tag belongs to BranchHop; ic-tracker-js is the TrackMyPoss half of the pair.

State goes in, JavaScript comes back

The controller builds a request from three values: the current site, the referrer and browser state saved in local storage. Its reply is a two-item JSON array. The first item replaces the saved state. The second runs through new Function, so the action can change without another edit to the compromised site.

infected page
  -> injected tag loads the controller
  -> controller reads this browser's saved state
  -> site, referrer and state go to the routing server
  -> reply replaces the state and supplies JavaScript
  -> the browser runs that JavaScript

The state key changed across copies. One form uses dmljdGlt, Base64 for victim. The controller captured on 11 October takes the first eight characters of the current hostname's Base64 value instead. That build splits its controller address across a string table and reconstructs the request in the browser.

A smaller controller, the same decision point

A controller body retained on 2 September was 43,719 bytes and buried its request behind a large string table and anti-debugging code. The 11 October build was 3,726 bytes. It kept the site, referrer and saved-state request, JSON parsing and new Function execution while dropping most of that packing.

The reply we retained sent the browser to an advertising page. That page asked for Web Push permission and configured Back-button and exit advertising zones. Other TrackMyPoss stages include a decoy news page with a timed reload, a /go/ traffic landing and the Punosy push script, which registers a subscription and reports affiliate event names.

What we see

Month	New sites
September	400
October so far	159

Of the 33 sites recaptured at least 25 days after their first match, 25 were still serving TrackMyPoss (76%). 92% of TrackMyPoss sites captured since 25 September run WordPress, and 51% of those run WordPress 7.1.

The injected tags often travel with other traffic code. 260 TrackMyPoss sites also carry BranchHop, and 51 carry Lnkr.

Checking a site

Inspect the logged-out HTML, JavaScript files and optimised copies for:

• ic-tracker-js loading an unfamiliar short path with a ten-digit ?ts= value
• the same address moved into data-rocket-src or data-wpmeteor-src
• a local-storage key named dmljdGlt, or code that Base64-encodes the hostname and keeps its first eight characters
• requests carrying the current site, referrer and saved state, followed by a two-item JSON reply
• the reply's second item passed to new Function

Remove the injected tag and the server-side change that writes it. Purge WordPress, server and CDN caches before checking the logged-out page again.