Security experts at Websense have discovered that cyber criminals have compromised the popular website AskMen.com and they used it to serve malware.
The attackers deployed several exploits to compromise the visitors, and if successful, the victim is infected with the Caphaw Trojan. Caphaw is banking trojan used to steal banking credentials from victims, it also allows the attackers to drop additional malicious payload on the victim’s system.
The malicious code installed on AskMen.com will attempt to exploit Java (most likely CVE-2013-2465) and Adobe Reader, experts believe that hackers used the Nuclear exploit kit for the attack.
“The exploit page displays similar obfuscation techniques, which are often used in the Nuclear Pack exploit kit. In addition, the above mentioned Java exploit is most often used by Nuclear Pack. These facts strongly indicate that the attacker is using either the Nuclear Pack exploit kit or a variant of it.” reported experts at Websense in a blog post.
In February YouTube users were targeted by a classic drive-by download attack by exploiting client Java software vulnerabilities and also serving Caphaw Banking Trojan.
Websense discovered the compromise early last week and has informed the portal administrators, but they haven’t recognized the discovery of the experts for this reason it is suggested to avoid visiting the website until the security issue isn’t resolved.
AskMen.com is a popular portal dedicated to men and ranked by Alexa within the top 1000 websites. The AskMencom portal is visited on monthly base by nearly 11.6 million users for this reason it represents a privileged target for attackers.
It is crucial that administrators will fix soon the security issue due to the high number of visitors that each day visits the website, in a few days tens thousands or hundreds thousands of people could be infected if their systems are not properly patched.
The lesson learnt is that no one is secure!
(Security Affairs – Askmen.com, malware)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.