Internet Explorer users can verify the web sites they visit by viewing the address bar or checking for valid security certificates. However, an attacker could make verification more difficult by opening the malicious frame in a popup windows to avoid displaying the URL, using a URL similar to that of the target or masking the URL by exploiting the vulnerability described in Microsoft Bulletin MS04-004 and Alert 7069.
To date, all reports of this exploit indicate that the weakness only lies in intercepting keystrokes, and is not an attack vector to gain a user's cookies or other information located on the user's system.
Microsoft considers this issue to be a bug and not a security vulnerability; however if used in conjunction with a phishing scam, a user
could easily be convinced to divulge personal information or usernames and passwords.
Exploit code has been publicly released for this vulnerability, increasing the likelihood of an attack.