By now most Internet users know what phishing stands for, or so they think. If you ask them to define phishing most will likely mention that it is about fake emails links that lead to look-a-like copies of popular websites. What most users do not know that their definition of phishing is not entirely correct. Phishing, which stands for Password fISHING, is not exclusive to email. The term hints at that little known fact. Phishing can occur everywhere including Instant Messengers, forums, by social engineering and on plain websites.
Aza Raskin just posted an interesting article on his blog detailing a new phishing attack that he calls Tabjacking. The concept of this new attack is ingenious.
It basically refers to a website that is changing its look and feels to a fake website after some time of inactivity. Here is how it works.
The web user visits a harmless looking site and decides to keep it open in a tab for now. A JavaScript code on the page notices that and replaces the site’s favicon and title with a popular site. This could be Facebook, Gmail or any other popular website that the user likely uses.