Chenette, manager of security research at Websense, calls the attack script fragmentation. Similar to TCP fragmentation attacks, it involves breaking down Web exploits into smaller pieces and distributing them in a synchronous manner to evade anti-malware signature detection.

"What this attack enables you to do is really get exploit code from the server into the browser memory and trigger the exploit," Chenette said. "Once you actually are able to trigger that exploit, you own that machine, so that means you can disable anti-virus, you can disable any protection mechanism after the fact."

How will botnets change tactics to stay active? Click here to read more.

The attack works like this: Malware authors write benign client code and embed it in a Web page. The only content contained on the initial page will be a small JavaScript routine utilizing XHR or XDR. This code contains no actual malicious content, and the same type of code is found on all of the major legitimate Web 2.0 sites.

Read the rest of this article on eWEEK.com.