This phish attack illustrates a new technique being used by phishers - 'hijacking' a legitimate domain to host the phish page on. This is mainly used to make the phish email slip through the URL blacklist spam filters.
The term ‘hijacked' is used with the presumption that the phishers have used some malware (a virus or a trojan) to gain remote access to the legitimate enterprise domain.
The phish message itself is quite plain - no AOL logos or the typical legal header and footer. The sender is not spoofed, either - the domain the message comes from is close to aol.com, but it's not it. The URL link is 'masked' - so the real URL the link takes to is not clearly visible: |
