Large Scale MySpace Phishing Attack

["Dancho Danchev" <dancho.danchev () gmail com>]

In need of a "creative phishing campaign of the year"? Try this,
perhaps the largest phishing attack spoofing MySpace and collecting
all the login details at a central location, that's been active for
over a month, and continues to be. A Chinese phishing group has come
up with legitimate looking MySpace profiles (profile.myspace.com) in
the form of subdomains at their original .cn domains, and by doing so
achieve its ultimate objective - establish trust through
typosquatting, remain beneath the security vendors radar by comment
spamming the URLs inside MySpace, and obtain the login details of
everyone who got tricked.

Complete assessment in the form of domains and URLs participating, as
well as the message used per domain for the internal comment spam
campaign, is available here :

http://ddanchev.blogspot.com/2007/11/large-scale-myspace-phishing-attack.html

Regards,
Dancho

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/