Interactive exploit kit redirection technique

JMH · Jun 20, 2014

The usual pattern we see when dealing with exploit kits starts with a legitimate website that gets compromised and used to automatically redirect its visitors to the actual malicious content. Techniques such as iFrame injection and HTTP redirections are frequently observed.
This week though, we found an interesting variation while doing research on some exploit kit traffic. We noticed that the compromised website contained code that actually interacts with the user by presenting a fake message about some script slowing down the browser.

Search

Search

Interactive exploit kit redirection technique

JMH

Emeritus, Contributor