Malware writers have unleashed a new trojan that takes advantage of an Internet Explorer (IE) vulnerability patched last week by Microsoft.
The trojan, which security firm Symantec dubbed "Naid," leverages an object-handling weakness that could be used to execute malicious code.
Researchers at Symantec have spotted attackers targeting trusted sites to foist the exploit.
The victim's machine is then hit with Naid, a remote access trojan first seen circulating in January 2010.
The Amnesty International site is now clean of the malware, according to Symantec.
"(Naid) is a trojan horse program that listens for and accepts a connection from the attacker to essentially provide unauthorised remote control functionality to the compromised computer over a custom communications protocol," a Symantec blog post said on Monday.
"This access allows the attacker to perform numerous nefarious activities such as stealing private information or monitoring internet activities."
Human rights and foreign policy sites are common targets. The same Amnesty International site was compromised just last month to spread a Java exploit, said researchers from the nonprofit Shadowserver Foundation.
Users are advised to install the latest patches (CVE-2012-1875) to protect against the threat.
This article originally appeared at scmagazineus.com
Copyright © SC Magazine, US edition
Issue: 336 | March 2015
Access CRN's extensive online resources including; email bulletins, community discussions and unique online news.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can log on to the CRN website or start posting comments on articles.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain '@crn.com.au' to your white-listed senders.