An “Inconvenient” Zbot lure

Sunbelt Software researchers turned up an interesting (infected) Web site that’s been taken over and used in a redirect to install Zbot on the machines of web users looking for Al Gore’s “An Inconvenient Truth” site. Search engines are beginning to find it too:

Here is the real site they’re looking for at http://www.climatecrisis.net/:


The infected site, hxxp://an-inconvenient-truth.com, (DO NOT GO THERE!) has been registered since 2006, so, it’s probably a legitimate site that’s been taken over.



Obfuscated JavaScript at the bottom, points to
hxxp://bl4ckst4r.cn/blog/go.php?sid=17, (DO NOT GO THERE!) which delivers Zbot, a Trojan that plants spyware on victims’ machines to steal banking log-in information.

Tom Kelchner