Alarms are ringing in Symantec's offices, as its research team discovered a massive Web injection campaign that's currently infecting Web servers around the Internet.
According to telemetry data received from Symantec security products, the company's staff has identified a common pattern in the source code of many websites.
Since the beginning of the year, unknown attackers have started adding the same piece of JavaScript code to multiple websites that should not be connected in any way.
Symantec estimates this number to be around 3,500, with over 75% hosted in the US, and the rest in India, the UK, Italy, Japan, France, Canada, Russia, Brazil, and Australia. Most of the infected websites belong to private businesses, educational institutes, and government websites.
Automated scripts help attackers exploit the infected sites
"More than likely the attackers are using automated scripts to scan these websites so they can automatically exploit bugs and possibly inject malicious HTML code into the vulnerable sites," explained Christian Tripputi, Security Response Manager for Symantec
According to telemetry data received from Symantec security products, the company's staff has identified a common pattern in the source code of many websites.
Since the beginning of the year, unknown attackers have started adding the same piece of JavaScript code to multiple websites that should not be connected in any way.
Symantec estimates this number to be around 3,500, with over 75% hosted in the US, and the rest in India, the UK, Italy, Japan, France, Canada, Russia, Brazil, and Australia. Most of the infected websites belong to private businesses, educational institutes, and government websites.
Automated scripts help attackers exploit the infected sites
"More than likely the attackers are using automated scripts to scan these websites so they can automatically exploit bugs and possibly inject malicious HTML code into the vulnerable sites," explained Christian Tripputi, Security Response Manager for Symantec