According to Websense, the two sites - 6 Music and 1xtra - were both injected with a malicious iframe at the foot of the page, loading code from a website in the .co.cc top level domain.
Carl Leonard, head of Websense's threat labs, said that, if an unprotected user browsed to the site they would be faced with drive-by downloads, meaning that simply browsing is enough to get infected with a malicious executable.
The payload, he explained, is delivered to the end user only once, with the initial visit being logged by the malware authors.
In his security blog on the saga, Leonard said that the code that is delivered to end users utilises exploits delivered by the Phoenix exploit kit.
A malicious binary, he added, is ultimately delivered to the end user.
"This attack is part of a current mass-injection targeting vulnerable websites. We shall continue to investigate this threat and offer protection to our customers from this and similar attacks", he said.
Reporting on the saga yesterday evening, ZDnet's Tom Espiner quoted Leonard as saying that he wouldn't expect sites like the BBC to host malicious code.
"The BBC has high profile websites, so the attack will be high impact", he told the reporter.