Forest Global Training Partners

Cyber Risks · Krebs on Security

Exploit Sat on LA Times Website for 6 Weeks

Summary: A subdomain of the Los Angeles Times, offersanddeals.latimes.com, silently redirected visitors to a site hosting the Blackhole exploit kit, and Avast telemetry showed the redirect had been running since at least December 23, 2012. Based on Alexa's estimate that the subdomain drew about 0.12 percent of the paper's roughly 18 million monthly unique visitors, Krebs estimated some 324,000 readers were likely exposed through the second week of February 2013.

Bottom line: The Times initially attributed the warnings to a Google display ad exchange glitch and said there was never any danger to users, before acknowledging the ad issue was a separate incident from the malware; meanwhile Sophos reported that 80 percent of the sites where it detects malicious content are legitimate sites that have been hacked.

Read the original at Krebs on Security ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026