Injected Script Loads Host.exe Using Hidden Iframes and Java Applets

Today, I can see many blacklisted sites where Google report one of the following three domains as a source of the problem:

• aubreyserr .com
• medien-verlag .de
• yennicq .be

E.g.

Malicious software is hosted on 1 domain(s), including medien-verlag.de/.

The attack is quite interesting so I decided to share results of my initial investigation here.
Continue »»