Phishers have switched tactics in their ongoing attempt to lift usernames and passwords from unsuspecting Yahoo users, a security company said, by turning to secondary sign-on pages, such as that for the Yahoo Photos image sharing service.

San Diego-based Websense said that crooks are sending out spam that claims to contains photos from a friend wanting to show off some recent pics, such as ones from a wedding or birthday. The messages include a link to a phony site, which captures the user's Yahoo ID and password, then passes the data to the real Yahoo Photos site.

Websense also reported that the majority of the spoofed sites using this trick are hosted by Yahoo's own GeoCities service, which offers 15MB of data storage and 3GB of data transfer per month at no charge.

Phishing criminals are always searching for sneakier ways to deceive Internet users. Last week, for instance, security vendor SurfControl noted that some phishers were using phony digital certificates to calm users' worries about suspicious sites.