Blog

Yesterday we noticed that one of the sites our Threatseeker technology was classifying appears to be using a typo-attack to infect users. The site is a typo attack on the real domain “freetrade.com” which is owned by Ameritrade / TD and is an online brokerage site. We are not including the real domain publicly since there is a variety of exploit code on the site, but its one character of the real site.

If accessed, and vulnerable, users will be redirected through a variety of encoded JavaScript exploit code that are included with the Web Attacker toolkit. Over the last two days the site has not had a lot of traffic, but has successfully infected more than 200 users (see screenshot below).

The exploit code loads a Trojan Horse Backdoor which has passwords stealing capabilities.

Web Attacker Statistics Screen on site:

Larger screenshot: http://www.websense.com/securitylabs/images/alerts/freetrade1.png