IT Jobs
New phishing attack adds live chat
Phishers use fake live chat to try to steal more data
By Robert McMillan | Computerworld US
Published: 10:31 GMT, 17 September 09
With many who bank online now wary of phishing attacks, criminals introduced a fake live chat window to their websites, where victims are tricked into revealing more information.
RSA Security spotted the first ever of these "chat-in-the-middle" attacks in the past few hours, according to Sean Brady, a manager with the security company's identity protection and verification group.
The phishers send e-mails that direct victims to a fake Web page designed to look like a banking site. That's a standard technique, but what's different in this case is that the phishing site comes with a fake online chat option, so that scammers can talk directly with their victims.
Phishers crack token-based security | New IE 7 bug could help phishers | Google anti-phishing site exposes user data | Thousands of Hotmail passwords stolen by phishers, admits Microsoft
After the crooks prompt victims for their credentials, they pop up a browser window designed to look like a chat session from the bank's fraud department. Then, via chat, they ask for even more information, including the victim's name, phone number and e-mail address.
The phishers used the open-source Jabber chat software, Brady said.
The attacks target a single US bank, which Brady declined to name. But he said there's a good chance the technique will become more widespread.
"If this person has any measure of success, I would anticipate that there will either be copycats or the fraudster will do this again with other institutions," Brady said.
Email
Print
Comment
Permalink
Contact Us
RSS
Digg
Add your commentComments