Phishing criminals are increasingly turning to cross-site scripting in order to cheat internet users out of money, according to Netcraft.
The technique is used by phishers to inject their own code into legitimate websites in a bid to dupe unsuspecting users to part with their account details or other personal information.
The network security services company said on its website that many large banks are still "neglecting to take sufficient care with the development and testing of their online banking facilities."
"Well known banks have created an infestation of application bugs and vulnerabilities across the internet," said Rich Miller, an analyst at Netcraft. He added that this allows fraudsters to insert their data collection forms into bona fide banking sites, creating convincing frauds that are undetectable to most customers.
He said a personal finance journalist writing for The Motley Fool was brave enough to publicly admit to having fallen for a fraud running on a banking site and having her current account cleaned out. "It's a reasonable premise that if a Motley Fool journalist can fall for a fraud, anyone can," added Miller.
A recent report by the Anti-Phishing Working Group (as reported in SC Magazine here). found that the level of phishing attacks rose by 42 per cent in January compared to the previous month. It also noted a growing trend in the use of cross-site scripting attacks.
