A fast-moving, large-scale trojan attack using the MPACK web exploit toolkit has infected nearly 10,000 web pages, downloading malware on end-user's PCs, according to security researchers at Trend Micro and Websense.