Yahoo IM may be a hack attempt

[collwen]

If you get a link from a yahoo instant message from someone on your friends list telling you to "click here for my new picture"- DON'T do it. It will prompt you for your id and password, as if it's in the protected section of yahoo/geocities images, but it's actually recording your id & password.

Then the people doing this go and change then yahoo account password (so you can't get into it), then go through the email in the looking for any emails that have other account ids and passwords- including other email accounts and bank accounts.

One of my co-workers just got *seriously* hacked by this.

I'm trying to see if there's any buzz or articles about it yet and I've not been able to find anything.

update: from ioldanach the technique is more correctly called phishing
update 2: I found a url on the issue- http://www.pcworld.com/news/article/0,aid,122707,00.asp

Comments

And the wheel goes round...

[pelgar.livejournal.com]

...had the same thing happen to me a few years back. There was a flaw in a browser plugin which allowed people to post malicious javascript to web pages like Yahoo via "sticky notes." Someone posted one to Yahoo/Geocities and logged usernames/password when it posted a page saying "Session Terminated."

I never did get access to my account/website back. Their idea of user ID verification was to send me an email asking for my Verification Question and Answer ... not sending me the question and accepting the answer I had set when creating the acct - but asking me what I had chosen for a question as well.

I even tried the route of saying "Look, I'm the guy paying the bills! I have the freaking credit card!" No go there either. And they wouldn't shut the account payments off either! So I stopped payment on the charges, and the pig-fuckers sold my domain name to a porn site.

Lessons:
1. Geocities sucks
2. Never register a domain through anyone but NetSol
3. Geocities sucks

Re: And the wheel goes round...

[collwen.livejournal.com]

ouch that sucks...