Exploit Packs Run on Java Juice
Summary: Krebs on Security reported in January 2011 that new exploit kits, including Dragon Pack and a $200 kit called Bleeding Life, were finding their greatest success with Java flaws, and that even fully-patched Java installations were enabling browser-based malware attacks. A Bleeding Life "exploit" is actually a social engineering attack that abuses built-in Java functionality to prompt visitors to run a malicious applet, a technique SANS warned about on Dec. 29 and Kaspersky tracked as a sizable uptick, with Trojan-Downloader.Java.OpenConnection reaching more than 40,000 detections in a 24-hour period and placing two representatives in December's Top 20.
Why it matters: The attack does not need a zero-day or an unpatched machine: with default Java settings, all a user has to do is click "Run" on a prompt, and Kaspersky counted over 40,000 infected computers in a single day at the family's peak.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026