Microsoft has confirmed reports of a recently active attack that surreptitiously installed malware on computers running a fully patched version 10 of the Internet Explorer browser. The attacks also work on IE 9, the company warned
The zero-day exploit was served on vfw[.]org, the official website for the Veterans of Foreign Wars, according to a blog post published Thursday afternoon by security firm FireEye. The people behind the attack compromised the VFW website and then embedded an iframe tag that silently loaded a page on another site that hosted the exploit. While FireEye researchers didn't identify the second site, Aviv Raff, chief technology officer of Israel-based security firm Seculert, said it was aliststatus[.]com. He provided the screenshot above, which he said showed the exploit in action.
The FireEye researchers wrote:
Read 6 remaining paragraphs | Comments