Glaswegian

With many who bank online now wary of phishing attacks, criminals introduced a fake live chat window to their websites, where victims are tricked into revealing more information.

RSA Security spotted the first ever of these "chat-in-the-middle" attacks in the past few hours, according to Sean Brady, a manager with the security company's identity protection and verification group.

The phishers send e-mails that direct victims to a fake Web page designed to look like a banking site. That's a standard technique, but what's different in this case is that the phishing site comes with a fake online chat option, so that scammers can talk directly with their victims.

Phishers crack token-based security | New IE 7 bug could help phishers | Google anti-phishing site exposes user data

After the crooks prompt victims for their credentials, they pop up a browser window designed to look like a chat session from the bank's fraud department. Then, via chat, they ask for even more information, including the victim's name, phone number and e-mail address.

The phishers used the open-source Jabber chat software, Brady said.

The attacks target a single US bank, which Brady declined to name. But he said there's a good chance the technique will become more widespread.

"If this person has any measure of success, I would anticipate that there will either be copycats or the fraudster will do this again with other institutions," Brady said.


http://news.techworld.com/security/3...-chat/?olo=rss