Amnesty International Site Serving Java Exploit
Summary: Amnesty International's UK homepage was compromised to serve malware that pulled a malicious Java applet from a hacked Brazilian automobile site, exploiting a recently patched Java vulnerability to deliver a Trojan detected as Spy-XR, a variant first seen in June 2011. Barracuda Networks consultant Paul Royal said the site appeared compromised since at least Dec. 16, and a ThreatExpert analysis tied the downloaded malware to China; Amnesty's Emerson Povey later said the exploit had been removed.
Bottom line: The attackers were not after financial data but likely the human rights workers who visit the site, and Royal noted that compromising a site those activists frequent means the targets come to you rather than needing to click a phishing link.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026