The UAB Spam Data Mine observed a new pattern this weekend, where phishers were trying to trick webmasters into giving up the userid and password for their websites. While most phishing attacks go after financial institutions, more than 90 webhosting companies were targeted in the attack, which imitated a "CPanel" login screen. If the webmaster entered their CPanel userid and password, the criminals can now edit their webpages. In the past, criminals have modified webpages to include "drive-by download" attacks, which could infect visiting computers with malware. More details are available on Gary Warner's blog,
CyberCrime & Doing Time, or in the
Washington Post's Security Fix column.
