Researchers on Friday continued to monitor a widespred IFRAME attack that exploits visitors to legitimate websites by installing an information-stealing trojan on their machines.