More than 60,000 websites hit by 'trojan cocktail'

A researcher has said the attack is similar to one used to steal credit and debit card numbers in a massive US breach last year.

A trojan cocktail' has hit legitimate websites in the UK and US, carrying a dangerous mix of backdoors, password stealers and downloader programs.

As of Friday, 55,000 websites had been affected, but this has now increased to 64,700, according to ScanSafe, the company that initially discovered the threat. This is around an eight per cent increase in just a few days.

The websites were affected as a result of an SQL injection attack. This is a way of tricking the database behind a website into responding to a normal search query as if it was a command to take some kind of action.

By tricking the database, the SQL injection attack tells the website to insert a malicious iframe onto its pages.

Once the legitimate website has been compromised, an intermediary site that hosts different exploits silently loads malicious content into the website while a user is browsing, looking for a vulnerability that it can take advantage of.

Once an exploit has been found, the trojan cocktail can be installed on a user's machine. Mac users can feel safe, as the cocktail is only targeting Windows PCs.

"The malware that is being downloaded consists of a backdoor, a trojan downloader and a keylogger," said senior ScanSafe researcher Mary Landesman speaking to IT PRO. "It all happens at the same time."

"This is the type of malware in terms of its inner workings very similar to what they had at Heartland Payment Systems," she added.

This was an incident in the US where the payments processor was the victim of a massive security breach, leaving customer transaction data and card numbers exposed.

Landesman said that there were a large number of UK sites that were impacted, which can be seen with a Google search on the iframe script tag. (It was advised that users should not click through unless they knew what they were doing).

Scrolling through the list, one of British websites affected included one belonging to the Royal College of General Practitioners.

Landesman said that in this particular attack, the attackers purposely avoided targeting government websites to avoid the type of the attention it could bring.

Featured Resources

Next-generation time series: Forecasting for the real world, not the ideal world

Solve time series problems with AI

Free download

The future of productivity

Driving your business forward with Microsoft Office 365

Free download

How to plan for endpoint security against ever-evolving cyber threats

Safeguard your devices, data, and reputation

Free download

A quantitative comparison of UPS monitoring and servicing approaches across edge environments

Effective UPS fleet management

Free download

Recommended

Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
What is a Trojan?
Security

What is a Trojan?

27 Aug 2021
New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021
HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
PayPal dismisses $45 billion Pinterest takeover as "market rumour"
Acquisition

PayPal dismisses $45 billion Pinterest takeover as "market rumour"

25 Oct 2021