CookieBomb Still Dropping Malicious Content

This report analyzes the "Cookiebomb" drive-by infection campaign in which obfuscated JavaScript injected into legitimate websites creates cookies and hidden 1px iFrames, fingerprints browser plugin versions, performs multi-stage redirections to evade detection, and ultimately drops a trojanous executable; the report provides deobfuscated code, attack URLs, Fiddler session evidence, and a long list of compromised sites while noting low AV detection (7/45).