Microsoft issued a an emergency patch for the vulnerability in the web browser yesterday. However, researchers at antivirus vendor Symantec's Security Response group began spotting dozens of websites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP.
The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.
Once it has infected a PC, the Trojan sends a notification email to the attackers, using a US-based, free email service that Symantec declined to name.
The IE flaw being leveraged in these attacks was also used to hack into Google's corporate network last December.
It has been linked to similar incidents at 33 other companies, including Adobe Systems.
The Google attack hit IE 6 on Windows XP, but over the past week hackers have found ways to exploit the flaw on more recent versions of the browser as well.
These latest techniques do not appear to be used on the websites Symantec has uncovered. They use the IE 6 exploit code, Talbot said.
Still, with IE 6 still being widely used, the move to more widespread attacks is worrying.
"It may be an indication that attackers have finally ramped up their attack toolkits and are now ready to launch widespread attacks," Talbot said.
He believes that the criminals are tricking victims into visiting their websites by sending spam email or instant messages with links to sites.
Websense published some sample emails used in targeted attacks that exploit the IE bug.
A typical subject line is 'Helping You Serve Your Customers'." The email reads, 'I just heard the news: Helping you serve your customers' and includes a link to the malicious website.
The emails contain spoofed addresses, designed to fool victims into thinking that they were sent by a colleague. The malicious Trojan used in the attack is not the same one that was used in the Google attack, however.
Websense has seen these emails sent to targeted companies in the UK and the US, said security research manager Patrik Runald.
"These attacks are actually continuing; they happened today; they happened yesterday and they happened the day before."
However, Websense believes that the emails it has tracked are part of a small-scale targeted attack, similar to those used on Google and Adobe in attacks that are ongoing.
Websense has counted only about 25 malicious websites to date, but the number is rising fast, Runald said.
Security experts believe this more targeted technique is used as part of a systematic cyber-espionage campaign, which some have linked to China.