Daily cyber threats and internet security news: network security, online safety and latest security alerts
December 16th, 2009

High Ranking Websites Spread Malware Through Cross-Site Scripting Vulnerabilities

Malware purveyors are exploiting web vulnerabilities in,, and a dozen other sites to foist rogue anti-virus on unsuspecting netizens.

The ongoing attacks are notable because they use exploits based on XSS, or cross-site scripting, to hide malware links inside the URLs of trusted sites. That’s something application security expert Mike Geide doesn’t see often. As a result, people who expect to visit sites they know and trust are connected to a page that tries to trick them into thinking their computer is infected.

“What’s interesting … is the fact that it’s embedding iframes to redirect people,” said Geide, who is a senior security researcher at Zscaler. “Typically, cross-site scripting is just that – it embeds script tags so it will embed javascript to run.”

The malicious links are blasted out on web forums and typically look something like:


The last chunk of test is hexadecimal-encoded HTML that redirects users to (do not visit). A series of redirect links ultimately leads to a site that looks similar to a Microsoft Windows screen with a popup claiming the PC is overrun with malware. The user is prompted to download rogue anti-virus to fix the imaginary problem.

While it’s not the most convincing attack we’ve ever seen, there’s nothing to stop attackers from using the same technique to push web-based exploits, say the Adobe Reader zero-day attack that’s now circulating in the wild.

The links work because and the rest of the sites being abused fail to filter out harmful characters used in XSS attacks. Here are a few examples with some of the malicious XSS advertisements (do not follow these or other “hxxp” URLs below):

Credit: The Register,

Share this item with others:

More on CyberInsecure:
  • Vulnerabilities In Both Principal London Mayoral Election Candidates Websites
  • Hacked Obama Site Redirects Visitors to Clinton’s Site
  • Drupal Multiple XSS and Request Forgery Vulnerabilities
  • Cross-site Scripting Vulnerability Found In MI5 Website By A Hacker
  • Facebook Mobile API XSS Vulnerability Used To Launch Spam Worm

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: High Ranking Websites Spread Malware Through Cross-Site Scripting Vulnerabilities

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.