Yahoo users in Romania, UK and France have been the main target of a malware infection which affected tens of thousands of users, according to Internet security company Fox-IT.

Basically, the infection led to malicious advertisements being served by Yahoo, according to Fox-IT, which discovered the infection on January 3. The investigation showed that the earliest signs of infection were at December 30, 2013. Other reports suggest it might have started even earlier.

“Based on a sample of traffic we estimate the number of visits to the malicious site to be around 300k/hr. Given a typical infection rate of 9 percent this would result in around 27.000 infections every hour. Based on the same sample, the countries most affected by the exploit kit were Romania, Great Britain and France. At this time it’s unclear why those countries are most affected, it is likely due to the configuration of the malicious advertisements on Yahoo,” according to Fox IT.

The company said it was clear the attack was financially motivated and seem to have offered services to other actors. Yahoo has already taken steps and fixed the issue.

editor@romania-insider.com