Phishing attacks up 1,000-fold since September

The number of phishing emails circulating on the Web has increased from 279 to 215,643 over the past six months, according to email security company MessageLabs.

Phishing is an Internet scam in which unsuspecting users receive official-looking emails that attempt to fool them into disclosing online passwords, user names and other personal information. Victims are usually persuaded to click on a link in an email that directs them to a doctored version of an organisation's Web site.

MessageLabs, which monitors corporate email traffic, said on Monday that in September 2003 the company encountered just 279 phishing emails. In January 2004 this figure reached 337,050 and then dropped back to 215,643 by March. The company said it is impossible to estimate exactly how many users have been fooled by the phishers. The UK banking industry body APACS said that last year, fewer than 100 people had fallen victim to phishing attacks.

The Anti-Phishing Working Group (APWG), which was formed in November 2003 to provide a forum for financial institutions to share information about new phishing campaigns, recently warned its members about an attack that can modify the victim's browser by replacing the address bar with a Java applet. This allows the attacker to take the victim to any Web site, but display the address of an official Web site in the browser's window, increasing the chances of fooling the users.

According to the APWG's Web site, the new attack targeted Citibank customers at the end of March: "This sophisticated new attack automatically detects the consumer's browser, and applies a custom JavaScript that replaces the look and feel of the Web address bar with an appropriately designed working fake. You can even type in the bank's Web address directly into the fake address bar -- this is a live piece of JavaScript code, not a static fake address bar image," the organisation said.