[Michael]

globalfundforeducation.org has been compromised.



Obfuscated JavaScript:



A little bit of fiddling around with the JS code allows us to display what it actually does:



An iframe:



Which is also referenced in the main code:



The final payload seemed to come from soft-siski.com in the form of several executables.

Jerome Segura

Warning: all links contained in this post may infect your computer!