The attack would not have been noticed by most users, Paul said. The attack starts when a users is sent a link through America Online Inc.'s instant messaging program or similar one.
The link is from someone in the user's contact lists, asking the user to click the link to MySpace to view photos, Paul said. The link leads to a fraudulent MySpace log-in page. Once the victim enters his information, he is then transparently logged into the real MySpace pages, Paul said.