Revision Note: Advisory published. Advisory Summary:Microsoft has investigated a public report of a phishing method that affects Web browsers in general, including Internet Explorer. The report describes the scenario of multiple, overlapping browser windows, some of which contain no indications of their origin. An attacker could arrange windows in such a way as to trick users into thinking that an unidentified dialog or pop-up window is trustworthy when it is in fact fraudulent. When a user visits a malicious Web site the user may be redirected to a trusted Web site. The attacker could then display an overlapping window in the form of a dialog box attempting a phishing attack. The user is then prompted to input personal information into this dialog box, which was opened from the malicious Web site. The user might believe that this dialog box was opened by the trusted Web site and they might input personal information. However, this information is sent to the malicious Web site. Browser Windows Without Indications of Their Origins may be Used in Phishing Attempts. Customers who already follow our general guidance about avoiding spoofing and phishing attacks are at reduced risk of being affected by this issue. If a particular window or dialog box does not have an address bar and does not have a lock icon that can be used to verify the siteâ??s certificate, the user is not provided with enough information on which to base a valid trust decision about the window or dialog box. To view Microsoftâ??s general guidance about how to avoid spoofing attacks visit the Security at Home Web site.
More...
