Known unofficially as 'Gumblar' for one of the attack domains, the malware is raising eyebrows and alert levels both for its prolific attack methods and for the danger of its payload.
Because the infection is so hard to get rid of, researchers say that Gumblar has enjoyed far more success than previous malware attacks.
First detected in late March, researchers thought that the attacks had been halted by mid-April when Google delisted the offending sites.
However, a new variant on the attack arose early this month and has since enjoyed nearly unprecedented success. Security firm ScanSafe estimates that Gumblar attacks have jumped some 188 per cent over the last week alone, and Sophos credits Gumblar with up to 42 per cent of all malware infections in the last seven days.
"The gross infection rate is exceptional, especially this late in the game," said Mary Landesman, senior security researcher at ScanSafe.
"Basically, it has been enjoying free reign."
The malware payload itself is also believed to be highly dangerous.
Landesman told vnunet.com that the malware intercepts web traffic such as Google search requests and redirects it to present fraudulent results, allowing the attackers to collect referral fees and placing the user at risk for further infection.
Additionally, she noted that the malware contains botnet controllers and is programmed to collect all FTP permissions on the infected systems, allowing Gumblar to infect any sites which the user administrates, further fostering the spread to new domains.