BURBANK, Calif. — RedTube announced this week via Twitter that it fixed a bug on its adult tube site that redirected users to malicious URLs and exposed them to Trojan horse viruses.
The highly trafficked MindGeek-owned property apparently was hacked via a malicious HTML iframe placed directly in the source code of the site and made invisible to the user.
The source code on RedTube's main page was modified in order to redirect the user to malicious URLs hosting the Angler Exploit Kit, according to security blog MalwareBytes, which first discovered and reported the breach.
Once redirected, the software kicks in and tries to exploit Adobe's recently patched CVE-2015-0313 bug to run malicious code, MalwareBytes said.
Officials of MindGeek’s RedTube division, in a response to MalwareBytes, said that the attack occurred this past Sunday for a “brief period of time.”
“Our security systems immediately detected the breach, and we took direct action to rectify the situation in order to protect RedTube users,” MindGeek told MalwareBytes.
“RedTube pursues stringent privacy requirements and maintains the highest industry standards of privacy protection to secure not only their assets and properties, but to provide comprehensive protection of their customers’ data when visiting a RedTube-owned site.
"RedTube is committed to providing their customers with an optimal online experience and the peace of mind when they are accessing a RedTube site.”
According to reports, RedTube is not the only adult tube site to have fallen victim to malware in recent months.
Another site, xHamster, was said to be serving up a Flash file that exploited a flaw via a malicious advertisement.