A security company in Bucharest has identified a Trojan aimed at replacing Google AdSense text with malicious ads. The malicious ad links could direct unsuspecting users to malware sites that could subject victims to additional attacks.

Google has already begun to cancel customer accounts that are displaying the bogus ads. The Trojan modifies the Host file on the victim's computer to redirect ad link visitors to an address not affiliated with the Google AdSense program and directs victims to load ad text from another source.

Most malicious code comes from online ads. DoubleClick and RealPlayer have been targeted in recent months with malware-embedded ads.