On the heels of recent iframe attacks, we’re currently tracking another mass compromise. This attack involves injection of script into valid web page to include a reference to a malicious .JS file (sometimes in the BODY, other times in the TITLE section). The .JS file uses script to write an IFRAME, which loads an HTML file that attempts to exploit several vulnerabilities, including:

  • MS06-014
  • RealPlayer (ActiveX Control)
  • Baofeng Storm (ActiveX Control)
  • Xunlei Thunder DapPlayer (ActiveX Control)
  • Ourgame GLWorld GlobalLink Chat (ActiveX Control)

This is one of those cascading threats, where one page leads to another and another, which leads to an executable, which leads to another and another. At least one of the payload trojans targets online gamers.

Preliminary research results suggest more than 10,000 pages were affected by this hack attack.

Similar attacks were observed in the past; most notable the infamous “Dolphin Stadium” (aka Super Bowl) attack was similar, which was later connected with SQL injection as the method used by the attackers to inject their malicious code. In cases where the TITLE tag has been modified, the browser’s title bar will show the script reference:


Example of browser title bar (censored)

McAfee’s designations for the various pieces of malware include:

  • Downloader-BGX
  • Exploit-RealPlay
  • JS/Exploit-BO.gen
  • VBS/Psyme

Analysis is ongoing.