In a blog post, Microsoft has acknowledged that some Hotmail users' accounts are being hijacked, a problem that has been previously discussed here. The article claims that a "worm or virus" is involved.

The post appears to refer to the same phenomenon that I've described. The official bulletin from Windows Live says that the hijacks are carried out by "spammers who send emails out advertising an electronics website". However, it also claims that the hijacked accounts will be used to send messages pointing to malware downloads. As yet, I haven't seen any signs of this second kind of message, although it's possible that those messages are being intercepted by our anti-virus solution.

The Microsoft bulletin does not mention that the 'electronics website' is actually a scam site, a so-called 'fake storefront' site that offers expensive electronics at too-good-to-be-true prices. Buyers who are foolish enough to try to purchase from these fictitious vendors are likely to find themselves out hundreds or even thousands of dollars.

There's just one troubling detail. Since writing about this, I've had two messages from Mac users who have had their Hotmail accounts hijacked by these scammers. There are various possible explanations. One, perhaps the most likely, is that the users in question may occasionally use PCs and thus exposed themselves to a virus. A second, rather less likely, is that the scammers have both Windows and Mac versions of their trojan. A third possibility is that Microsoft is wrong about the involvement of a trojan, and that some other mechanism is exposing Hotmail passwords to the scammers.

I'm inclined to keep an open mind on this. As I say, the most likely explanation is that the Mac users had their passwords compromised when they used a borrowed PC to check their email — at the office, or while traveling, for example. But if I were Microsoft, I'd want to consider carefully the possibility that some other mechanism might be at work, one that doesn't involve installing anything on the user's computer.