Security software company Symantec has reported phishing sites posing as secure financial websites may download keylogging software — hardly news, except that these sites are freshly exploiting security holes in QuickTime, Apple’s popular multimedia playing software, and WinZip, a Windows utility for file compression and decompression.

Symantec reported their find during the second week of May 2007, after one of their PCs used as bait was infected through these vulnerabilities, even though the WinZip security hole was found as early as November 2006, and the QuickTime security hole is circa January 2007 (a security patch is available).

[Via CNET]