Icarus Publishing Blog Hit by Failed Malware Attack (Updated Again)

Just a heads-up for anyone trying to hit up the blog for erotic manga publisher Icarus Publishing this morning.  It’s been hit by an injection attack and is tripping Firefox’s built-in attack site filter when attempting to access the site as well as the filter for Chrome, and IE8. Thankfully, the site isn’t compromised with any malware from my tests. I’ve gotten in touch with publisher Simon Jones and this is what he had to say:

I’ve been working on this since morning, when it was first discovered through Google.  Appears to be some sort of php injection attack.  It affected one javascript file, which has been replaced.  It created a iframe which pointed to a webpage that no longer exists, so it is likely that even while the site was compromised, no malware was actually downloaded.

So far, no ETA on when the blog will return to normal but I’ll update on any new developments.

Update: The following message now greets visitors to the blog

5/17/2010

Dear visitor,

This site was recently compromised by a javascript-based injection attack sometime this week. It has been closed until we can clean the server and remove the trojan. We expect to restore the site within a few days.

The hack involved a “Clagent.B” exploit affecting our WordPress installation, creating an iFrame that pointed to a webpage on the hingham-ma.gov domain that did not exist as of this writing. The attack appears to have happened sometime between 5/16~5/17. However, out of an abundance of caution, please perform antivirus and and anti-rootkit scans on your computer if you have visited this site within the past month.

Our apologies for any inconvenience.

Update 2: The blog is back to normal.