Fraudsters are using Yahoo's photos storage service to try and steal internet users’ identities.
Internet security software company Websense said a number of internet phishing attacks were using the Yahoo photos service as a front to try and harvest Yahoo users’ usernames and passwords.
Yahoo users receive an e-mail or instant message that claims to be from a friend sending them photos of a recent event, such as a holiday or a birthday party.
The message contains a link to a phishing site, which records the user's Yahoo ID and password before forwarding the ID and password to the real Yahoo photos site.
Websense said most of the phishing sites were hosted in the US on the free web space provided by the Yahoo Geocities service.
Once the phishers have access to users’ e-mail or instant messaging accounts they can use them for fraudulent transactions, or search the users’ messages to find other usernames and passwords used for logging into bank accounts and other financial services.