eSafe CSRT has recently discovered a new massive Web attack where a malicious iframe pointing to a remote exploit is being planted on compromised legitimate websites. The iframe points to an Mpack exploit kit, detected by eSafe as JS.Agent.hdd, hosted on a Chinese server. The exploit kit in its turn downloads a new improved version of the Russian Trojan horse called Gozi Trojan, which is detected by eSafe as Win32.Agent.gjs.

The Gozi Trojan is designed to steal sensitive information and to send it to a predefined address. It has been noticed that this new version of Gozi Trojan transfers the stolen data to an IP address located on Malaysia.

The following TCP Stream shows the Gozi Trojan in action:

More than 600 legitimate websites have fallen victim to this attack. The list includes a popular pro-Israel website and a private banking service website located in the Cayman Islands. Visiting the bank’s main page or any of the compromised websites triggers the exploit and ends up downloading the Gozi Trojan into the victim’s system.