A New Way to Phish Could Hook Even Wary Users

So, you've decided to log into your bank's website to figure out if you can afford the newest techno-bling shown at CES. Your bank gives you the nod, and you open up another browser tab (or window) to cruise over to your favorite tech reseller. After doing a few price and stock checks, a pop-up window appears: your bank session has timed out - and if you want to double-check your available credit or account balance, you need to log in again. Should you click and go? If you shrug and say "sure," you'd probably be infected by the latest phishing method. As reported by ArsTechnica , "in-session" phishing doesn't use traditional methods such as fake emails or fake websites to do its dirty work. Instead, in-session phishing is the next step in exploiting legitimate sites that are infected by malware . This time, infected websites exploit a JavaScript flaw found in all popular browsers. To learn how it works, and to learn how to protect yourself, join us after the jump. read ... (link)