New phishing attack adds live chat
Phishers use fake live chat to try to steal more data
By Robert McMillan | Computerworld US | Published: 10:31, 17 September 2009
With many who bank online now wary of phishing attacks, criminals introduced a fake live chat window to their websites, where victims are tricked into revealing more information.
RSA Security spotted the first ever of these "chat-in-the-middle" attacks in the past few hours, according to Sean Brady, a manager with the security company's identity protection and verification group.
The phishers send e-mails that direct victims to a fake Web page designed to look like a banking site. That's a standard technique, but what's different in this case is that the phishing site comes with a fake online chat option, so that scammers can talk directly with their victims.
Related Articles on Techworld
After the crooks prompt victims for their credentials, they pop up a browser window designed to look like a chat session from the bank's fraud department. Then, via chat, they ask for even more information, including the victim's name, phone number and e-mail address.
The phishers used the open-source Jabber chat software, Brady said.
The attacks target a single US bank, which Brady declined to name. But he said there's a good chance the technique will become more widespread.
"If this person has any measure of success, I would anticipate that there will either be copycats or the fraudster will do this again with other institutions," Brady said.
