What do you get when you cross a phishing e-mail with a virus? I don’t know exactly, but the thought makes my blood run cold.
A bright red alert that I first saw this afternoon reports that some visitors to the American Express secure website are seeing the following pop-up dialog box, which asks them to enter their Social Security number, mother’s maiden name, and date of birth – enough information, in short, to open dozens of credit accounts and steal an identity:

Let me repeat the really chilling part: According to American Express, people are seeing these pop-ups when they’re on AmEx’s secure site!
The AmEx page that warns about this scam is very short on details, but it suggests that they first received notice of this attack around March 29, 2006. The security alert also contains this hint that the culprit is a piece of malware:
Please note that this fraudulent activity may be the result of a computer virus and is not a part of the American Express website. If you received this pop-up box, your computer may have this virus.
In recent years, malware distributors have been mostly interested in setting up bot networks for relaying spam and hosting phishing messages. Some trojans with keylogging capabilities, like those in the PWSteal family, attempt to spot web-based forms where you enter credit card or banking information and scrape their contents to send to an outside source. Attackers running phishing scams have mostly worked via e-mail, and the tools for detecting and blocking phishing attacks are getting better. So this represents a significant escalation. When you see a pop-up dialog box while logged onto a secure site run by a reputable financial institution, you might be fooled.
I haven’t seen this documented elsewhere, and a search at some leading AV sites turns up nothing. If American Express is alarmed enough to put out a public warning, it must have hit a significant number of their clients. Anyone have any further information on what this thing could be?