It seems some rather nasty types are using Guardian Unlimited in their new email scam. A report from Websense - passed on by my eagle-eyed colleague, Richard Wray - tells of an email which displays a short excerpt from an Associated Press story, under a Guardian Unlimited headline and with an accompanying link which leads to malware.
If the link is followed, the malicious website displays a slightly modified version of the full story. Immediately after the website has loaded, encoded JavaScript embedded in the page attempts to compromise the workstation with two HTML Help exploits.
In the event that either of the exploits are successful, a Trojan downloader is placed on the workstation. The Trojan begins downloading a second malicious file, which is also a Trojan. The second Trojan has backdoor functionality that gives the attacker complete control of the workstation.
These emails, of course, have nothing to do with Guardian Unlimited - they are simply using our name to try and lure people into downloading malicious code onto their machines. Be wary: and, if you want more information, there's an advisory here.
