Widespread site compromise leading to Zeus

Over the past few weeks we have been tracking another widespread compromise of legitimate web sites. Huge numbers of sites have been injected with a malicious JavaScript that attempts to load content from an exploit site when innocent users browse the affected pages.

Compromised pages are blocked by Sophos products as Mal/ObfJS-AB. The scale of the attack is evident when looking through our threat prevalence data - Mal/ObfJS-AB has risen to the top of the web threats, accounting for almost 25% of all reported threats.