The Latest in IT Security

Popular Media Sites Involved in Mass Compromise


Today, Zscaler identified yet another mass website compromise, this one impacting a number of popular media sites, including two radio stations in Washington, DC – Federal News Radio and WTOP. It’s not clear if all of the sites impacted were leveraging a common backend platform that may have led to the compromise.

Sadly, mass compromises are now the norm. Attacks targeting end users generally involve some form of social engineering whereby the potential victim must be convinced to visit a site, download a file, etc. Attackers will therefore write a script designed to comb the web looking for popular sites exposing a common flaw and when identified, inject a single line of malicious code into the sites. In that way, any user visiting the otherwise legitimate (but now infected) site, can become a victim. This particular threat also displays another common trait – being dynamic in nature and only delivering content if the victim browser exhibits certain attributes. In this case, the injected content is only displayed when the browser’s User Agent string reveals that Internet Explorer (IE) is being used.  When IE is used to view one of the infected pages, the following code is sent to the browser:

Ofuscated JavaScript injected into a webpage at
Deobfuscated version of the injected code

This obfuscated JavaScript decodes to reveal an iFrame pointing to sites hosted at Dynamic DNS (DynDNS) hosting providers. Thus far, we have identified two DynDNS providers ( and involved and the actual URLs (which are numerous), conform to the following pattern:

Example URL

Once redirected to the malicious URLs, Fake AntiVirus scams and the ZeroAccess Trojan are delivered to the victim. MD5s for malware delivered include the following:


Thus far, Zscaler has identified the following compromised sites:
Media Sites
  • WTOP Radio (Washington, DC) -
  • Federal News Radio (Washington, DC) -
  • The Christian Post -
  • Real Clear Science -
  • Real Clear Policy -
At the time of posting, these compromised sites were still offering up malicious content.

Leave a reply





Latest Comments

Social Networks