Security experts at Websense have discovered that cyber criminals have compromised the popular website AskMen.com and they used it to serve malware.
The attackers deployed several exploits to compromise the visitors, and if successful, the victim is infected with the Caphaw Trojan. Caphaw is banking trojan used to steal banking credentials from victims, it also allows the attackers to drop additional malicious payload on the victim’s system.
The malicious code installed on AskMen.com will attempt to exploit Java (most likely CVE-2013-2465) and Adobe Reader, experts believe that hackers used the Nuclear exploit kit for the attack.
“The exploit page displays similar obfuscation techniques, which are often used in the Nuclear Pack exploit kit. In addition, the above mentioned Java exploit is most often used by Nuclear Pack. These facts strongly indicate that the attacker is using either the Nuclear Pack exploit kit or a variant of it.” reported experts at Websense in a blog post.
In February YouTube users were targeted by a classic drive-by download attack by exploiting client Java software vulnerabilities and also serving Caphaw Banking Trojan.
Websense discovered the compromise early last week and has informed the portal administrators, but they haven’t recognized the discovery of the experts for this reason it is suggested to avoid visiting the website until the security issue isn’t resolved.
AskMen.com is a popular portal dedicated to men and ranked by Alexa within the top 1000 websites. The AskMencom portal is visited on monthly base by nearly 11.6 million users for this reason it represents a privileged target for attackers.
It is crucial that administrators will fix soon the security issue due to the high number of visitors that each day visits the website, in a few days tens thousands or hundreds thousands of people could be infected if their systems are not properly patched.
The lesson learnt is that no one is secure!
(Security Affairs – Askmen.com, malware)