said by The Reg :

---

This week, researchers from the anti-virus provider uncovered at least two high-profile websites hacked so they try to infect visitors with some of the nastiest malware out there.

But as they were busy pointing out the attacks on web pages belonging to Swedish rock band The Hives and web blogs award site the Bloggies, nearly a dozen Trend Micro pages were busy trying to launch their own assaults, this Google search shows. The same malicious javascript at the heart of the Trend Micro attack had, at time of writing, managed to inject itself onto almost 23,000 pages in all.

"Unfortunately, safe surfing measures can be useless as even the most trusted Web sites can be hacked to serve up malware," Trend Micro's JM Hipolito wrote on Monday when analyzing the attack on the Bloggies. Evidently, he didn't know just how correct he was.

A Trend Micro spokesman said the malicious iframes have already been removed and that steps have been taken to prevent the injection from happening again. He didn't have additional details.

As we reported earlier today, the mass infection causes the once-benign sites to turn against their visitors by attempting to install password loggers, backdoors and other types of malware on their machines. The attacks appear to be the handiwork of a single criminal gang, according to McAfee researchers, who first discovered the cluster of hacked sites. They are part of a growing preference of miscreants to spread malware using legitimate websites that have been compromised rather than through destinations specifically set up for that purpose.

If even security providers like Trend Micro (and a few months back, Computer Associates) can't protect their visitors from these assaults, chances are good that plenty of others can't either.

---