Thousands of websites in China have been booby trapped with code written to download Trojan software onto visitors who run vulnerable Windows PCs.

Unlike earlier rounds of SQL injection attacks the latest assaults mostly target English language sites (predominantly sites hosted in China but with a .com suffix) and purposefully avoid Chinese government sites, according to net security firm ScanSafe. The latest attacks inject an iFrame onto compromised sites that loads malicious scripts from qiqigm.com, a domain registered on 16 May. These scripts includes the text "silent love china" in an apparently greeting to other Chinese hackers

The malicious code exploit well-known RealPlayer and Internet Explorer vulnerabilities to install a password-stealing Trojan that hides its presence on Windows PCs. More than 7,000 sites have been compromised in this way, reports Mary Landesman, ScanSafe's senior security researcher.

English language Hong Kong stock brokerage kgieworld.com and Kodak camera reviews at digitalcamerareview.com are among the sites hit by the drive-by download attack.

The attacks are the latest in a wave of SQL injection attacks against websites that began this month. More than one group, using different sets of tools to inject attack code, is involved, according to F-Secure, the net security firm

Trend Micro says two exploits used in the latest SQL injection attacks are related to Chinese-language software, suggesting miscreants are specifically targeting the Chinese speaking world. Its analysis - which includes graphics illustrating the attack - can be found here. ®

Related stories

• Drive-by download attacks menace UK.gov (23 July 2008)
• US cyberspying fears hang over Beijing Olympics (21 July 2008)
• Microsoft and HP tackle SQL-injection scourge (26 June 2008)
• Tennis sites hit by drive-by download attacks (25 June 2008)
• Interview Trend Micro's CEO says 'AV industry sucks' (22 June 2008)
• 'Legit' website compromises reach epidemic proportions (5 June 2008)
• Cybercrooks plant phishing scam on crime reduction website (3 June 2008)
• Phoenix Mars website invaded by hackers (2 June 2008)
• Botnet sics zombie soldiers on gimpy websites (14 May 2008)
• Drive-by download attack compromises 500K websites (13 May 2008)
• Web infection attacks more than 100,000 pages (24 April 2008)
• Updated Security gumshoes locate source of mystery web compromise (16 April 2008)
• Database Trojan infests pro-Tibet websites (14 April 2008)
• Euro 2008 sales site in drive-by download attack (31 March 2008)
• Mass compromise powers massive drive-by download attack (13 March 2008)
• Unpatched RealPlayer bug paves way for drive-by downloads (12 March 2008)
• Reduce your exposure to AJAX threats (18 February 2008)
• Web browsers on the front line of exploitation (15 February 2008)
• Hackers seed malware on Indian anti-virus site (8 February 2008)
• Hackers turn Cleveland into malware server (8 January 2008)