Funny Myspace bulletin - NOT! Beware of Phishing

A few days ago, I received my first scammy Myspace bulletin - A rather weak phishing attempt at getting me to enter my username and password on a bogus Myspace login page - Thanks, but I'll pass. Anyway, I thought I'd share my experience with you just in case you ever run into something similar or, in case you already have.

Phishers attempt to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business in an electronic communication (source: Wikipedia). In our case, we're talking usernames and passwords and the "trustworthy business" that they are masquerading as, is Myspace.

Here's a look into a few of my fun-filled moments this past Tuesday night:

I logged into my Myspace account like any other day. In my bulletin section I noticed that a good friend of mine had posted a new funny bulletin titled, "OMG! Check this out!"(see below).

Screen one of Myspace Phishing attempt

First word of caution. These bulletins CAN come from your very good friends; often your friends simply aren't aware that they are using an account that has been compromised.

Back to Tuesday night...

Clicking on the link I'm taken to the next screen where I get a brief, albeit vague, blurb about something that I apparently "have to see!". Of course, not a whole lot is going on this particular Tuesday night, so I bite! *click*.

Screen two of Myspace Phishing attempt

The screen below shows where I was taken after clicking on the link. Hmmm...I'm being prompted to login to my Myspace account again. I wonder what happened? Oh well I'll just put my username and pass in the cute little boxes and get on to my "must see" bulletin link - NOT!

Screen three of Myspace Phishing attempt - note the fake URL

Look closely at the image above. What looks like a normal Myspace login page is in actuality, a cleverly crafted copy of a Myspace login page. Look at the URL highlighted in yellow. That's not the normal Myspace URL is it? The Phishers have simply appended "myspace.com" to the end of a bogus URL hoping to fool the unsuspecting; I'm guessing quite a few people fall for it. The URL, in fact, has nothing to do with Myspace at all. It's just a catch-all page that collects username and passwords from people that don't know any better. That's its sole purpose. The "have to see" bulletin that I was chasing...well...doesn't exist.

If this has happened to you GO CHANGE YOUR PASSWORD now!

Things to think about while reading bulletins:

1. If you are prompted to enter your username and password after clicking a bulletin link, IT'S A SCAM! Do not give out your personal information. If you really think you've been logged out, close your browser, re-open it, TYPE http://www.myspace.com in the address bar and go there directly to login. If the bulletin still prompts you for your details, fugetaboutit!

2. This is more a personal choice but it will save you some IE (internet explorer) vulnerability headaches; Go download, and use the Firefox browser instead.

Source: Tom Thomas