Cyber-attackers hacked one of the sites belonging to the U.S. Postal Service to redirect visitors to an attack portal containing Trojans. The attackers used a kit to launch the Javascript attack.
The USPS national customer support center, ribbs.usps.gov, was compromised using the Blackhole Exploit Kit, researchers at Zscaler said April 7. Attackers injected malicious Javascript on the USPS site that inserted a redirect code to take users to a different site.
The USPS has taken down the infected site and it appears the page the attackers redirect visitors to is offline as well. As of early April 8, Google still reported the site as “may harm your computer” on its search results page and Firefox flagged it as a “Reported Attack Page.”
The initial Javascript code injected on the page was obfuscated as each letter was encoded using its ASCII equivalent. To any user, it looks like a series of numbers enclosed within a