Magento sites targeted by Neutrino exploit kit – It is not yet clear how Magento sites were infected.
Some websites running the Magento e-commerce platform appear to have been infected with code that directs victims to the Neutrino exploit kit.
It is not yet clear how the Magento sites were infected, writes Denis Sinegubko, a malware researcher at Sucuri.
“So far, we suspect that this is a vulnerability in Magento or one of the third-party extensions, which allowed the infection of thousands of sites in a very short period of time,” he says.
Magento sites are rigged to pull content in an iframe from a domain that has been blacklisted by Google, Sinegubko said. According to Safe Browsing service, the malicious domain was responsible for infecting more than 7,800 websites.
This malicious domain has also been detected by security firm Malwarebytes, and was found to be linked to the Neutrino exploit kit, says Jerome Segura, a senior security.
Exploit kits are 'planted' by cyber attackers on legitimate web pages. When a user visits these pages while browsing ,the exploit kit scans the computer for vulnerabilities in the user-visitor's software and, if any are found, secretly, without the user realizing it, distributes the malicious software.
The malicious domain that Sucuri detected was the one that Malwarebytes had detected after being prompted by web-browsing clients, Segura said in his comments.
