Blackhole Exploit Kit Continues It’s Dominance

This report describes an investigation of malicious iframe injections on legitimate webpages used to deliver the Blackhole exploit kit. The author documents heavy obfuscation in HTML body tags, demonstrates manual de-obfuscation to reveal malicious /index.php?tp= URLs, shows the exploit payloads that target older vulnerabilities and download binaries, and notes low antivirus detection — indicating an active drive-by exploit campaign employing evasive TTPs.