Barclays Bank customers hit by phishing attack

Security software specialist Panda Software said that it has detected a large scale phishing attack that is directed against customers Barclays Bank’s online services. According to Panda, there were at least 61 variants of spoof emails circulating on Tuesday, five new versions with different subject fields surfaced today.

The software company estimates that "several million" emails containing the attack. Just like previous and similar attacks, the emails appear to have been sent from the customer service of the bank. The message text, imitating Barclays’ corporate image, tells users that the bank is upgrading software and that they should go to a link in order to confirm their bank details. Users that click on the link will access a form, similar to those used by the bank, requesting their account number, credit card number or PIN.

Not all email messages point to the same Internet address, Panda said. The attack appears to have been coordinated through at least five false domains to make it more difficult to close all of them down. The software maker said that the phishing servers are located in Korea, Colombia and Hongkong.

"This is a sophisticated attack in comparison with those that we usually see. The use of several domains to host spoofed web pages makes it more difficult to disable them. The emails are also far more authentic looking than the usual, often error strewn, messages," said Ryan Sherstobitoff, Panda’s security spokesperson.