More than 60,000 websites hit by 'trojan cocktail'

A researcher has said the attack is similar to one used to steal credit and debit card numbers in a massive US breach last year.

A trojan cocktail' has hit legitimate websites in the UK and US, carrying a dangerous mix of backdoors, password stealers and downloader programs.

As of Friday, 55,000 websites had been affected, but this has now increased to 64,700, according to ScanSafe, the company that initially discovered the threat. This is around an eight per cent increase in just a few days.

The websites were affected as a result of an SQL injection attack. This is a way of tricking the database behind a website into responding to a normal search query as if it was a command to take some kind of action.

By tricking the database, the SQL injection attack tells the website to insert a malicious iframe onto its pages.

Once the legitimate website has been compromised, an intermediary site that hosts different exploits silently loads malicious content into the website while a user is browsing, looking for a vulnerability that it can take advantage of.

Once an exploit has been found, the trojan cocktail can be installed on a user's machine. Mac users can feel safe, as the cocktail is only targeting Windows PCs.

"The malware that is being downloaded consists of a backdoor, a trojan downloader and a keylogger," said senior ScanSafe researcher Mary Landesman speaking to IT PRO. "It all happens at the same time."

"This is the type of malware in terms of its inner workings very similar to what they had at Heartland Payment Systems," she added.

This was an incident in the US where the payments processor was the victim of a massive security breach, leaving customer transaction data and card numbers exposed.

Landesman said that there were a large number of UK sites that were impacted, which can be seen with a Google search on the iframe script tag. (It was advised that users should not click through unless they knew what they were doing).

Scrolling through the list, one of British websites affected included one belonging to the Royal College of General Practitioners.

Landesman said that in this particular attack, the attackers purposely avoided targeting government websites to avoid the type of the attention it could bring.

Featured Resources

BCDR buyer's guide for MSPs

How to choose a business continuity and disaster recovery solution

Download now

The definitive guide to IT security

Protecting your MSP and your customers

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Recommended

HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
What is a Trojan?
Security

What is a Trojan?

25 Feb 2021
Data breach exposes widespread fake reviews on Amazon
data breaches

Data breach exposes widespread fake reviews on Amazon

7 May 2021
TsuNAME vulnerability could enable DDoS attacks on major DNS servers
distributed denial of service (DDOS)

TsuNAME vulnerability could enable DDoS attacks on major DNS servers

7 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021
Qualcomm modem flaw puts millions of Android users at risk
Google Android

Qualcomm modem flaw puts millions of Android users at risk

6 May 2021