Phishing attacks take a new twist
In recent months, the researchers at security software company Websense detected a rise in schemes involving malicious programs known as keyloggers, according to the March phishing trends report released Wednesday by the Anti-Phishing Working Group.
The technology, which records the keystrokes of people using infected machines, could be designed to help phishers stay one step ahead of honest folk. In the past, attackers have relied mainly on e-mail messages that lure victims to malicious Web sites, where they are duped into disclosing logins and usernames for banking sites and other sensitive online accounts. The messages are typically spoofed to look like they come the bank or other trusted provider.
The keylogger programs are built specifically to capture login names and passwords for online bank accounts and to send them to the attackers, Websense Security Labs said. They typically exploit vulnerabilities in Microsoft's Internet Explorer browser program.
Each week in March and February, Websense uncovered as many as 10 new keylogger variants and more than 100 new Web sites set up to infect computers with them. That's up from November and December, when the company's researchers identified an average of one-to-two new variants and 10 to 15 Web sites per week.