Google Pages the Free Web hosting service from Google was being used by hackers to steal money from visitors using a Trojan Horse.

Websense warned that a Trojan horse is being hosted on a site with the same IP address as the Google Pages Web site.

The site is hosted on the same IP address as the main http://www.googlepages.com site. The file is packed with ASPack and is a banking Trojan Horse which is designed to steal banking credentials upon visiting pre-defined financial institutions sites.

The Trojan appears to have been noticed before its authors have managed to launch an attack, Websense said. The company has not yet detected e-mails or IM links leading back to the Trojan, which is designed to steal bank details relating to certain financial institutions.

The Trojan, also known as a "keylogger" for its ability to record keystrokes, is programmed to know when a user visits a bank site, and to then activate the keystroke recording function, said Ross Paul, a senior product manager at Websense.


Send to a friend | Permalink | Del.icio.us | Go To Top
Translate: