A new phishing scam targets bank and PayPal passwords and other consumer data that criminals use to loot private accounts. The new ploy doesn’t require victims to visit phony Web sites to fill out forms that appear legitimate. Instead, spammers send the forms as HTML attachments to e-mails. Chrome and Firefox browsers don’t pick up on this activity as malicious because not many compromised PHP servers get reported so their URLs don’t make the blacklists. Most users aren’t sophisticated enough to discern the URL from the PHP submission, M86 says.”]