[vyper]

http://forums.mozillazine.org/viewtopic.php?t=215178

Click that right now and follow the instructions.

If your paypal account is cleaned out tomorrow morning don't say I didn't warn you.  

[Rictor]

...what on Earth are you talking about?

[vyper]

[q]Quoting neowin.net
According to a paper recently published by Eric Johanson of the Shmoo Group, users on most Mozilla-based browsers (Firefox 1.0, Camino .8.5, Mozilla 1.6, etc), Safari 1.2.5, Opera 7.54, Omniweb 5 are victim to a complex International Domain Name [IDN] spoof.

This new attack allows an attacker/phisher to spoof the domain/URLs of businesses. Every recent gecko/khtml based browser implements IDN (which is just about every browser except for Internet Explorer). The Smoo Group have created a proof of concept where the links are directed at "http://www.p****72;ypal.com/", which the browsers punycode handlers render as www.xn--pypal-4ve.com.

According to the group there is however an easy to way to detect you're under a spoof attack, cut & paste the url you are accessing into notepad or some other
tool (under OSX, paste into a terminal window) which will allow you to view what character set/pagecode the string is in. You can also view the details of the SSL cert etc.

.[/q]

See the link I posted for a temporary workaround.

[Grey Wolf]

Thanks for the link. Not that I use PayPal, but can't hurt to fix anyway.

[WMCoolmon]

Indeed. Thanks.

[Taristin]

Might be a good idea to do the same for the thunderbird file of the same name, no?

[Grey Wolf]

Why would you click an unknown link in an e-mail in the first place?

[WMCoolmon]

They're pretty dastardly. They'll do something like link a URL, so it looks as if the URL was just typed in, but in reality links to some unknown IP address. Usually it's in a fairly official-looking PayPal email spoof.

I've gotten quite a few. I don't have a Paypal account though.

[pyro-manic]

Good to know. I use paypal a fair bit for ebay and the like. Thanks.

[vyper]

Yeah I got an e-bay one a while ago - it was seriously convincing, right down to the header - the only thing that tipped me was the fact it started asking for confirmation of passwords and bank card security numbers... heh.

Edit: Irony, I'm sitting talking about spoof e-mails and I get one claiming to be a M$ patch. Ah those fools.

[pyro-manic]

Odd. I don't think I've ever had a malicious e-mail of any kind. In fact, I hardly get any junk mail at all - no more than one or two a month...