We have encountered reports of two new Yahoo phishing sites. The first one is located at geocities.com/worlds_funniest_jokes_2754. The site entails users to use Yahoo! Flickr beta. This is with reference to Yahoo’s buying of Flickr, a popular photo-sharing service. The deal was reported by CNet in an article that was published last
March 20, 2005.However, flickr remains to be a standalone service and no reports of integration to Yahoo have been seen or launched. The phish asks users to login and try the service. The link is being ‘advertised’ using IM messages via Yahoo messenger. These IM messages even come from a trusted contacts (whose contact info may have been compromised), so we suggest verifying links being sent to you. Below is a screenshot of the said site.

The second one is a phish of Yahoo 360 service. This one is also being advertised through Yahoo Messenger. The phishing site can be found at uk.geocities.com/picnic_photoalbum. Below is a screenshot of the aforementioned phish site.

The sites were already sent to our Web blocking team for the appropriate solutions.

Just another heads up for you guys. We found another proof-of-concept code that targets Microsoft Powerpoint 2003 service pack 2 (French version).

We have submitted the sample to the service team for verification. Do hold on for updates.

Update (Chachi, Sat, 05 Aug 2006 09:59:42 AM)

This is now detected as TROJ_MDROPPER.BD.