IFRAME-injecting Linux rootkit discovered

Researchers are analyzing a new rootkit that they believe signals the latest development in criminals’ attempts to secretly compromise websites with the goal of directing users to exploits.

Details of the rootkit were posted anonymously Tuesday on the Full Disclosure mailing list, leading researchers from security firms CrowdStrike and Kaspersky Lab to study the malware. The anonymous poster, who runs a web service, found the rootkit on company servers after customers said they were redirected to malicious sites.