News
Security Alert by Websense
November 2008 by Websense
Websense Security Labs ThreatSeeker Network has discovered that numerous Halloween-themed Web sites have been compromised as Halloween approaches and users are more likely to visit.
One particular example is a Web site selling Halloween costumes. The deobfuscation returned by ThreatSeeker shows that the JavaScript has multiple layers of obfuscation. The script contacts a malcious server in the .biz TLD. Within the ThreatSeeker network, we have seen almost ten thousand sites infected with the same obfuscation technique.
Another example is a US-based retailer using the Halloween theme to promote its products. This Web site is infected with a redirection that points to a gpack exploit kit. The ThreatSeeker network is currently tracking over thirteen-thousand sites infected with these patterns.
Not only malware authors take advantage of seasonal events. Numerous recently registered proxy Web sites are using the Halloween theme to allow users to bypass traditional URL filtering solutions.
Websense Messaging and Websense Web Security customers are protected against these threats.
