TrackMyPoss affiliate fraud kit

TrackMyPoss is an affiliate-traffic controller injected into WordPress sites and other pages. We have matched it on 742 sites since 2 August.

Research by Kirk

TrackMyPoss in numbers

Since 2 August, the first TrackMyPoss match in our records, counted on 12 November 2026. How we count.

Sites with TrackMyPoss code	742
Sites with a match in the last 30 days	269
New sites in October	301
Still serving it when recaptured at least 25 days later	84 of 167 sites (50%)
Sites running WordPress (captured since 25 September)	59%

WordPress injections and a compromised Shopify CDN

Sucuri documented /* trackmyposs*/ in a 2022 WordPress campaign that appended obfuscated JavaScript to jquery.min.js, jquery-migrate.min.js and the database. The decoded injection added a remote script and redirected visitors through advertising pages (Sucuri). TrackMyPoss loads from a compromised page, asks a server what to do and runs its answer.

Shopify stores get it another way. The actor took over vaultcdn[.]electricapps[.]net, the CDN of a once-legitimate Shopify app, and served the staged controller loader from it as /lib/jquery-ui-min.js. Stores that load the app's script load TrackMyPoss with it.

State goes in, JavaScript comes back

The controller builds a request from three values: the current site, the referrer and browser state saved in local storage. Its reply is a two-item JSON array. The first item replaces the saved state. The second runs through new Function, so the action can change without another edit to the compromised site.

infected page
  -> injected tag loads the controller
  -> controller reads this browser's saved state
  -> site, referrer and state go to the routing server
  -> reply replaces the state and supplies JavaScript
  -> the browser runs that JavaScript

The state key changed across copies. One form uses dmljdGlt, Base64 for victim. The controller captured on 11 October takes the first eight characters of the current hostname's Base64 value instead. That build splits its controller address across a string table and reconstructs the request in the browser.

Controller builds and advertising redirects

A controller body on 2 September buried its request behind a large string table and anti-debugging code. The 11 October build was much smaller. It kept the site, referrer and saved-state request, JSON parsing and new Function execution while dropping most of that packing.

The reply sent the browser to an advertising page. Other TrackMyPoss stages include a decoy news page with a timed reload and a /go/ traffic landing.

What we see

Month	New sites
September	207
October	301
November so far	11

Of the 167 sites recaptured at least 25 days after their first match, 84 were still serving TrackMyPoss (50%). 59% of TrackMyPoss sites captured since 25 September run WordPress, and 36% of those run WordPress 7.1.

The injected tags often travel with other traffic code. 14 TrackMyPoss sites also carry BranchHop, and 103 carry Lnkr.

Checking a site

Inspect the logged-out HTML, JavaScript files and optimised copies for:

obfuscated code appended to jQuery files you did not change, or a script from vaultcdn[.]electricapps[.]net
a local-storage key named dmljdGlt, or code that Base64-encodes the hostname and keeps its first eight characters
requests carrying the current site, referrer and saved state, followed by a two-item JSON reply
the reply's second item passed to new Function

Remove the injected loader and the server-side change that writes it. Purge WordPress, server and CDN caches before checking the logged-out page again.