270K WEBSITES INJECTED WITH ‘JSF-CK' OBFUSCATED CODE

Summary from the TLDR InfoSec newsletter

Nearly 270K websites have been compromised with malicious JavaScript Injectors that are obfuscated using the ‘JSF-ck method.' This method uses six ASCII characters to produce working JavaScript code by relying on JavaScript's type coercion to encode numbers and letters using crafted combinations of the characters. It leads to very long and easy-to-detect code, but is challenging to unobfuscate without specialized tools.