Yahoo is reporting on a story from London based MessageLabs LTD. about a new tool which could be used to phish for your customers internet banking information.

Once the phishing email is opened a script is launched. Currently this script is targeted at three Brazilian banks. The script changes the users bookmarked address for the bank or redirects the user when they go to that site. So the user believes they have gone to the same site they always did. This time it may look similar, but asks for new information to confirm the users identity. This is where the theft actually occurs.

This script could be modified to any other web address. Thus far only 30 such emails have been found. But this could escalate. The Gartner Group estimates 3% of those targeted by phishers actually reveal personal information. As the crooks get better, that number may increase unless a new level of awareness is created in your user base.

Operating systems with Windows Script Host enabled are vulnerable to this. Windows Script Host lets users run VBScript and JScript scripts within the Windows operating system. Bankers should consult with their IT department to determine if this should be enabled on your systems or not, and adjusted accordingly. You may also consider its use to navigate your site and provide your customers with instructions on disabling this, or of taking precautionary measures.