Skip to main content

Keylogger hosted on Google Pages

Don't be surprised if you receive a fraudlent Paypal email that links to a page hosted on Google servers. Malicious program authors may be using the free web hosting service by Google to host malware. And since the page is residing on Google, lot of anti-spyware products may never block it.

In a recent case, WebSense has discovered a trojan hosted on Google Pages, a .
The site is hosted on the same IP address as the main site. The file is packed with ASPack and is a banking Trojan Horse which is designed to steal banking credentials upon visiting pre-defined financial institutions sites.
The Trojan appears to have been noticed before its authors have managed to launch an attack. Websensehas not yet detected emails or IM links leading back to the Trojan, which is designed to steal bank details relating to certain financial institutions.