Monster.com identity attack may claim more vicitims

"While their final purpose is different, their modus operandi is very similar, using identical file names, creating the same system folder, injecting code into the same processes and hooking the same system functions using root-kit techniques to gain control of network functionalities and to steal sensitive information," said Hidalgo. "They share code and a number of traits that could indicate they were developed by the same group or perhaps created using a kit."

Monster.com's Sylven defended the service's automated searches and said that although the company monitors database activity, stolen credentials have been used in the past to access the system. Moreover, he said, it's difficult to tell a valid automated search generated by a real person from one cranked out by software. "Many of our larger customers rely heavily on our database, and their use may be similar to programmatic or scripted access," said Sylven.

He could not confirm that the stolen accounts had been disabled, although Hidalgo noted in a blog entry posted Friday afternoon that Symantec had notified Monster of the compromised log-ins. "When unusual access is detected, we do terminate that access and investigate if possible," Sylven said.