Tabnabbing: A New Type of Phishing Attack

"Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You've escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site.
What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking. That'll catch us by surprise."


How the attack works:

1. A user navigates to the attacker's normal looking site.
2. The attacker detect when the page has lost its focus and hasn't been interacted with for a while.
3. Replace the favicon with the Gmail favicon, the title with "Gmail: Email from Google", and the page with a Gmail login look-a-like. This can all be done with just a little bit of Javascript that takes place instantly.
4. As the user scans their many open tabs, the favicon and title act as a strong visual cue—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they'll see the standard Gmail login page, assume they've been logged out, and provide their credentials to log in. The attack preys on the perceived immutability of tabs.
5. After the user has entered their login information and the attacker sent it back to his server, the attacker redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.
   Code:

   http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/

Firefox's fix: Firefox Account Manager
So be careful what's happening on the open tabs in the background behind your back and always check the url before you login somewhere!

thanks for the information

Wow that's clever!

I think there's a bit of javascript in a sticky in the black hat forum for thi.?

Sent from my HTC Desire using Tapatalk