Cybercriminals -- in a sign of the times -- have used a legitimate Web site in a phishing attack aimed at Kiwibank, according to Sophos.
Customers of the New Zealand bank were sent an e-mail which invited customers to perform routine "account maintenance" to ensure that the bank can "guarantee their money".
Paul Ducklin, Sophos's Head of Technology Asia Pacific, said the phishing e-mail doesn't read like one that you would expect a bank to send.
"And the link in the e-mail leads off to a Web server in the USA which is currently blocking downloads, so there seems to be little risk of customers getting caught out."
While the risk of being hooked may be low, Ducklin believes there is a lesson to be learned from the campaign.
"SophosLabs currently estimates that 70 percent of malicious Web pages abused by phishers and malware spreaders are not directly associated with cybercriminals, but rather are legitimate sites which have been broken into and borrowed for criminal activity," he said.
Legitimate sites also lose in these scams. The Web site used in the Kiwibank phish appears to be that of a sole trader in the US. "That site is now widely blacklisted, and off the air," Ducklin said.
"The genuine owner of the site is left to sort out the mess."
