Some 8 million web pages, published mostly by smaller merchants and professional firms, have been hijacked this summer and set up to usurp control of the PCs of unsuspecting site visitors.
That's the latest development in a new style of hacking sweeping across the Web, according to research by website security firm Armorize.
"The misuse of numerous small sites is making the Internet a much more dangerous place," says Alena Varkockova, lab analyst at antivirus firm Avast. "Even the unimportant sites can do big harm when misused."
A single criminal gang using computer servers located in the Ukraine is responsible for the latest twist in converting legit web sites into delivery mechanisms for "driveby downloads," according to Wayne Huang, chief technical officer at Armorize.
In a driveby download, malicious software gets inserted into the web browser of any unsuspecting Internet user -- just by navigating to a hacked web page. These silent attacks first appeared in 2005 and became pervasive in 2008.