A wave of VexTrio attacks using dictionary domain generation algorithm (DDGA) has infected numerous websites built on Wordpress, which in turn infect visitors to those sites with malware or spyware by executing Javascript code