full-disclosure - Large Scale MySpace Phishing Attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 19 Nov 2007 20:52:30 -0800
From: "Dancho Danchev" <dancho.danchev@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Large Scale MySpace Phishing Attack

In need of a "creative phishing campaign of the year"? Try this,
perhaps the largest phishing attack spoofing MySpace and collecting
all the login details at a central location, that's been active for
over a month, and continues to be. A Chinese phishing group has come
up with legitimate looking MySpace profiles (profile.myspace.com) in
the form of subdomains at their original .cn domains, and by doing so
achieve its ultimate objective - establish trust through
typosquatting, remain beneath the security vendors radar by comment
spamming the URLs inside MySpace, and obtain the login details of
everyone who got tricked.

Complete assessment in the form of domains and URLs participating, as
well as the message used per domain for the internal comment spam
campaign, is available here :

http://ddanchev.blogspot.com/2007/11/large-scale-myspace-phishing-attack.html

Regards,
Dancho

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/