I think the particularly interesting thing about this isn't the malware in question, but the vector they're using to distribute it. Almost every HTML page written in the last 5 years has jquery included somewhere, and so they're clearly trying to provide a redirection (or script-injection) vector which would pass a glance over the site code. If you run a website and have a breach it's worth being aware of during the code inspection you'd have to make.
Comments
>We keep seeing fake jQuery sites popping up and being used to distribute malware.
Anyone has more info? What kind of malware? I'm assuming client side? Any 0-days? Unsurprisingly, both websites are blocked at where I am.
I think the particularly interesting thing about this isn't the malware in question, but the vector they're using to distribute it. Almost every HTML page written in the last 5 years has jquery included somewhere, and so they're clearly trying to provide a redirection (or script-injection) vector which would pass a glance over the site code. If you run a website and have a breach it's worth being aware of during the code inspection you'd have to make.