I went to post a comment on a friends MySpace profile tonight, and I clicked the top navigation banner to go Home to my main screen. I could have chosen Mail or Bog does not matter. Instead I got re-directed to a login screen and thought it was a corny flaky MySpace server. It was not, I looked at the URL and guess what? I had been phished. And IE7's Phishing filter does not even have a clue (Nor does the latest version of FireFox.). I had to report the profile to MySpace saying I think the user did not know and I told my friend his theme is phishing people for passwords. I know my friend would not do this, so what is the point?
When you apply a theme to MySpace from a theme site, test out the MySpace links and if they try to phish someone, report them to MySpace and get your theme from another site.
How do you know if you maybe phished?
Your in the middle of doing something and your asked to login. I know MySpace does this on occasion due to a server hiccup or an expired cookie, but if Internet Explorers password fill-in does not work or just look up the the URL is www.cake.fi with a MySpace login. Immediately let the user know and go directly back to MySpace by typing www.myspace.com.
If, like me did not catch it change your password. Here is a catch, cannot be more than 10 characters long. Kinda hard to make one to remember and be secure? Why are there these limitations on services, if your gonna put one on make it 25 characters or something.
Update: The website takes your login info, runs a script on myspace and it will add the phishing info to your profile. It sticks the code at the end of your About Me section so look for foreign code and you can then remove it. Like mine I saw Cakeit in it so I deleted all that plus up to the <Style and then I saw I lost the nav bar, so I went and deleted to the next <style and it was back to normal. Please check back, I may edit / add more later.