First posted on 22 June 2012.
PWS:HTML/Phishbank.A is also known as Mal/ObfJS-B (Sophos).
PWS:HTML/Phishbank.A is a personal-information stealing malware, that may be presented in a variety of ways, including:
- As a webpage that you may receive as a link in an email
- As an attachment sent in spam email
- In a pop-up advertisement
- As embedded or inline advertising within legitimate webpages
If you open this file in a browser, the malware displays a web-form similar to the following:
The web-form invites you to enter your personal information to become a paid 'mystery shopper'.
The personal information you enter may then be used to involve you in more elaborate phishing scams.
When you click the "Register" button, any information you have filled in is sent to a remote host at:
The PHP script than redirects the page to google.com.
Analysis by Oleg Petrovsky
Last update 22 June 2012