Injecting Malicious HTML IFrames – Still A Popular Attack Vector

A widespread web compromise was observed where attackers injected malicious IFrames into many legitimate sites (search results indicate ~85k infected pages). The injections, likely achieved via SQL injection and persistent XSS in forums and dynamic pages, redirect users to malicious .ru domains (a list of IFrame URLs is provided) and have triggered Google warnings for some affected pages.