PageFair says small percentage of users were at risk from attack

CEO Sean Blanchfield wrote that 501 publishers that use the company's javascript tag were affected.

Ninety percent of publishers have less than ten million page views per month, and 60 percent have less than one million page views per month, he wrote.

PageFair has calculated that about 2.3 percent of the visitors to those sites would have been at risk of being infected.

The attackers gained access to a key email account at PageFair and then reset the password for a PageFair account at a content distribution network (CDN).

The CDN was used to serve a javascript tag created by PageFair that collects data about websites. The hackers swapped out the javascript tag for their own malicious code, which was then served by some publishers that use PageFair's tag.

"This intentionally harmful javascript prompted visitors to install a fake Adobe Flash update, which appears to be a botnet trojan that targets Windows," Blanchfield wrote.

The attack was noticed within five minutes, but it took PageFair 83 minutes to completely stop the attacks.

Blanchfield wrote that an analysis of the malicious code delivered indicated that the majority of antivirus programs wouldn't have detected it at the time of the attacks.

But for the attacks to be successful, users would have had to approve the download of the executable file delivered, which Windows would have warned about, he wrote.

F-Secure wrote on its blog on Monday that the malware delivered was a remote access tool called NanoCore.