The Websense® ThreatSeeker® Network has detected that a FOREX trading website was injected with a malicious Java applet, which could install malware on the affected systems of the site’s users. FOREX is the foreign exchange market where international currencies are traded, and nowadays, it’s used by millions of people around the world.
The targeted website is a popular FOREX website called “Trading Forex,” located at hxxp://tradingforex.com. One of the questions that is raised when encountering such a compromise is whether some cybercriminal shift their focus from mainstream online money management systems of banks and stock exchanges to “easier wins” with online systems and services that are likely to be less mature from a security perspective. Another interesting fact is that the dropped backdoor at Trading Forex is written in Visual Basic.Net and requires the Microsoft’s.NET framework to be successfully installed and operational on the victim’s computer.