This story was corrected throughout to name Expedia.com as one of two sites found by Trend Micro and Sandi Hardmeier to be serving malicious banner ads. While Excite.com has been found in the past to also host attack ads, there are no recent reports it has done so recently.
Expedia.com and Rhapsody.com are the latest name-brand websites to be found serving advertisements that try to install malware onto users’ machines, security researchers said. The sites join a Rogue’s Gallery of mainstream destinations that include MySpace, Excite, Blick, and CNN.com, which all have been caught carrying tainted ads over the past few months.
Both Expedia and Rhapsody hosted banner ads that produce messages falsely claiming end users should install software that will fix malware infections or other problems that plague their machines, according to a research note from Trend Micro. The messages are produced using malicious links injected into the ad graphics, which use Adobe Shockwave. Frequently, such ads are tailored to look strikingly similar to official Windows dialog pop-ups, in an attempt to trick the users.
The rogue ads on Expedia were reported earlier this week by Microsoft MVP Sandi Hardmeier’s blog. An update Wednesday produced additional banners she said were malicious.