Yahoo visitors got a nasty New Year’s surprise when third-party advertisements on the site triggered drive-by malware infections. Around the end of December, Yahoo inadvertently began serving malicious ads, also known as “malvertisements,” that redirected visitors to a site hosting the Magnitude exploit kit. This resulted in drive-by malware downloads for thousands of unsuspecting users who merely visited the Yahoo site — even those who didn’t click on anything.
Yahoo quickly removed the ads and says it is working with law enforcement to investigate.
While we don’t know exactly how the malvertisers infiltrated Yahoo’s advertisement network, we are familiar with this type of attack.
This blog post examines some of technical details of the attack to help security professionals spot and combat this type of threat.
