Web Reconnaissance Attack Infects 3,500 Websites, Possibly WordPress

frogboy

In memoriam 1961-2018
Thread author
Verified
Top Poster
Well-known
Jun 9, 2013
6,720
69,342
7,679
Western Australia
Alarms are ringing in Symantec's offices, as its research team discovered a massive Web injection campaign that's currently infecting Web servers around the Internet.

According to telemetry data received from Symantec security products, the company's staff has identified a common pattern in the source code of many websites.

Since the beginning of the year, unknown attackers have started adding the same piece of JavaScript code to multiple websites that should not be connected in any way.

Symantec estimates this number to be around 3,500, with over 75% hosted in the US, and the rest in India, the UK, Italy, Japan, France, Canada, Russia, Brazil, and Australia. Most of the infected websites belong to private businesses, educational institutes, and government websites.

Automated scripts help attackers exploit the infected sites
"More than likely the attackers are using automated scripts to scan these websites so they can automatically exploit bugs and possibly inject malicious HTML code into the vulnerable sites," explained Christian Tripputi, Security Response Manager for Symantec