During the attack, victims receive a spoofed e-mail that appears to be from an address with the URL yahoo-inc.com, Yahoo's internal e-mail domain. The e-mail then attempts to convince the user that their Sponsored Search account is about to become suspended and replaced with an upgraded account complete with geo-targeting and other new features. Subsequently, the phishing e-mail then requests the user to confirm his or her username and password, and provides a link leading to a phishing page.

The e-mail reads as follows:

Dear Advertiser,

We just want to remind you that, on August 25, 2009, your Local Sponsored Search account will be discontinued. You will be upgraded to a new Sponsored Search account with geo-targeting and other great new features.

Please note the following: In order for us to upgrade your account you need to verify your user/password of your account. Please remember to input your Sponsored Search user and password correctly NOT your email and password.

Please visit the following link to verify your account: hxxp://onlinemarketingyahoo.com/adui/signin/loadSignin.htm

Sincerely,

Your Partners at Yahoo! Search Marketing Copyright 2009 Yahoo!, Inc. All rights reserved.

While the attackers attempt to mimic a legitimate letter from Yahoo Sponsored Search, there are some giveaways about its authenticity. For one, users should be alerted to the phish by the generic greeting, security experts say.

Security experts say that the phishing attack, discovered by researchers at MX Logic, is similar to Google Adwords phishing campaign in May 2008, which attempted to steal login credentials to Google Adwords site from customers.

"Note the generic nature of the introduction, which should generally be one of your first tipoffs that the e-mail is not authentic," said Sam Masiello, researcher at MX Logic, in a blog post. "If you have a personal relationship with a company and they wanted to send you an important e-mail communication they would use your real name."

Masiello also said that there's a missing period between online marketing and Yahoo in the URL. Even still, the actual URL for the Yahoo marketing service is searchmarketing.Yahoo.com, not onlinemarketing.Yahoo.com.

And, of course, the letter is just grammatically incorrect enough in the second paragraph to arouse suspicions.

"The potential audience being targeted by this e-mail is somewhat limited because it will only make sense to those who are customers of this Yahoo product," Masiello said. "That rarely seems to stop most spammers."