" An active phishing campaign targeting account holders at popular Bitcoin exchange MtGox.com has hijacked the top search results at Bing and Yahoo.com, redirecting unwary clickers to mtpox.com, a look-alike domain and Web site that was registered on June 12, 2013, less than 24 hours ago.
Check out the video I recorded of this phish in action (turn down in the sound if you hated the Iron Man soundtrack):
Update, June 17, 3:07 p.m: Googles Youtube team has inexplicably removed my video, calling it a violation of YouTubes policy on the depiction of harmful activities. 8:09 p.m.: YouTube has restored the video. Hover over the search links returned in Yahoo.com after searching for Mtgox and youll see what appears to be a paid or perhaps sponsored search ad that lists a result for mtgox.com, although hovering over the link displays a long yahoo.com URL. The same is true when you currently search for mtgox on Bing.com: hovering over the returned link shows a bing.com address.
In the video above, entering any credentials at the fake mtpox.com site caused a site error, but when I tried it again a moment later, I was redirected to the real Mtgox.com.
Interestingly, it appears the phisher in this case simply copied and pasted the code from Mtgox.com; as shown in the video, hovering over either the username or password field on mtpox.com produces the same warning present on mtgox.com a message advising visitors to check for the green extended validation or EV browser certificate in the URL address bar.
This attack, while not particularly unusual, is a good reminder that relying on trusted bookmarks is among the safest ways to navigate to sites that hold your personal and financial information. Using a search engine to find these sites is better than direct navigation (in which a fat-fingered key can lead to a phishing site), but as this phish illustrates, its always a good idea to double check the URL in the address bar."
Check out the video I recorded of this phish in action (turn down in the sound if you hated the Iron Man soundtrack):
Update, June 17, 3:07 p.m: Googles Youtube team has inexplicably removed my video, calling it a violation of YouTubes policy on the depiction of harmful activities. 8:09 p.m.: YouTube has restored the video. Hover over the search links returned in Yahoo.com after searching for Mtgox and youll see what appears to be a paid or perhaps sponsored search ad that lists a result for mtgox.com, although hovering over the link displays a long yahoo.com URL. The same is true when you currently search for mtgox on Bing.com: hovering over the returned link shows a bing.com address.
In the video above, entering any credentials at the fake mtpox.com site caused a site error, but when I tried it again a moment later, I was redirected to the real Mtgox.com.
Interestingly, it appears the phisher in this case simply copied and pasted the code from Mtgox.com; as shown in the video, hovering over either the username or password field on mtpox.com produces the same warning present on mtgox.com a message advising visitors to check for the green extended validation or EV browser certificate in the URL address bar.
This attack, while not particularly unusual, is a good reminder that relying on trusted bookmarks is among the safest ways to navigate to sites that hold your personal and financial information. Using a search engine to find these sites is better than direct navigation (in which a fat-fingered key can lead to a phishing site), but as this phish illustrates, its always a good idea to double check the URL in the address bar."