The recently discussed Internet Explorer exploit (demonstrated here) - that allows scammers to fake secure sites - won't be seeing a fix this month by Microsoft. Their security bulletin for January doesn't even mention the flaw, which has given birth to an unlimited wave of new "phishing" scams. The January update does offer a patch - which patches a previous patch - and aims to resolve an OS buffer overrun vulnerability, but the company has been oddly quiet about the IE exploit.

The rather simple exploit allows a scammer to present a completely bogus link/website as both genuine and secure, a tactic that has made scams such as those long-seen by customers of Earthlink and Paypal that much more potent. The exploit takes advantage of the fact that the Internet Explorer address bar is incapable of displaying the special character "%01", or any data that comes afterwards; allowing scammers obfuscate the true website address rather easily.

Users are sent an e-mail informing them their accounts need updating, then directing users to these seemingly genuine sites to input that information. According to the website Anti-Phishing.org, such scams were up 400% this past holiday season. Such high-profile targets as Visa, Bank of America, and Citibank are only the latest in a long list of targets.

The exploit has been rated "moderately critical" by Microsoft, and according to Microsoft officials they're still working on a fix "that is as well engineered and thoroughly tested as possible." According to Microsoft's new monthly patching schedule, the next series of patches should be released on February 10. In the interim (considering how long it took them to solve pop-ups, you may be in for a wait), you can find recommendations on how to avoid getting hooked by phishing scams at this portion of the FTC website.