IDG News Service reports that a bug found in all major browsers could make it easier for criminals to steal online banking credentials using a new type of attack called 'in-session phishing', according to researchers at Trusteer.
In a usual phishing attack, criminals send out millions of bogus email messages that look like they come from legitimate sources, such as banks or online payment companies.
Those messages are often blocked by spam-filtering software, but in-session phishing, the email message is replaced by a pop-up browser window.
IDG News Service explains, "Here's how an attack would work: the bad guys hack a legitimate website and plant HTML code that looks like a pop-up security alert window. The pop-up would then ask the victim to enter password and login information, and possibly answer other security questions used by the banks to verify the identity of their customers."
Klein has alerted browser companies though, who presumably will develop patches. Also see Agencies compile list of 25 worst security threats story below.