I've been seeing the exact same injected script on several of my websites for the last few weeks. Today I realize these websites don't share the same hosting servers, yet the attacks (1) started at the same time (2) are identical.
Does this prove that my FTP passwords have been stolen (they're all stored in Filezilla XML file on my hard drive), otherwise what else could be the security hole?
Also, is it reasonable to store FTP passwords in a file locally? If not, how should they be stored?