M86 labs told that pages were infected with IFRAME with involved Phoenix EK
http://labs.m86security.com/2012/01/mas ... %E2%80%99/
http://labs.m86security.com/2012/01/mas ... %E2%80%99/
A forum for reverse engineering, OS internals and malware analysis