New (?) phishing scam only requires user to read E-mail

Full article here

There seems to be a new phishing technique, that requires nothing more of a user than opening an E-mail.

Exploiting Windows Scripting Host and/or ActiveX, that E-mail executes a script that alters the content of the Windows hosts file. Effectively, it assigns different IP's to Domain names, and points users that use that domain name to a forged website.

It goes without saying if you are using outlook for you email disable all scripting.

This can be checked / configured in outlook as follows

Tools -> Options

Under the "Security" Tab

Under Secuirty zones section

Click on the zone settings button next to the zone you have selected

Then click customer level. Scroll down the list of radio buttons and check that you have all ActiveX / Scripting options set to disable.

Anouther artical on the same subject.

And another.