Legitimate Web sites are increasingly becoming unwitting sources of malware. Security experts report that Expedia.com and Rhapsody.com today have been serving up banner ads that attempt to get visitors to download fake antispyware, while embassy Web sites in Ukraine and Russia have also been spewing out attack code this week.

"Expedia and Rhapsody are both serving up Shockwave ads with malicious code," says Jamz Yaneza, research project manager at Trend Micro, which has shared its findings with both online e-commerce companies.

At Expedia.com, a banner with malware dubbed SNF_ADHIJACK.A has tried to direct anyone who clicks on it to a site to install a Trojan called TROJ_GIDA.A, Yaneza says.

"These Shockwave banner ads being served are malicious," says Yaneza, who notes that the content banner may appear to be from a legitimate source. (Learn more about antispyware products in our Antispyware Buyer's Guide.) 

Earlier this week, the Web sites for the Embassy of the Ukraine in Lithuania, the Embassy of the Netherlands in Russia, and the Ministry of Foreign Affairs for the country of Georgia were all found to be compromised and serving up attack code to visitors.

"We know these Web sites have been compromised," says Ofer Elzam, director of product management for Aladdin Knowledge Systems' eSafe division. "They're trying to infect the visitor's PC to turn it into a proxy using an iFrame exploit."

Elzam says Alladin Knowledge Systems has submitted its findings to these embassies. He notes the type of attack used against these Web sites bears some similarity to the well-known Alicia Keyes MySpace compromise.

A report recently published by WebSense addresses the issue of legitimate sites being hacked and turned into malware-emitting sites. The WebSense report claims that 51% of sites it classified as malicious in the second half of 2007 had been compromised by attack code. The remaining 49% were intentionally designed to propagate malware.