The attack is noteable because it does not use suspect techniques like cross site scripting to fool users. Instead, plain old HTML is used to bury the MySpace.com content on the page and provide the simple login screen for users. That means that automated tools that Myspace uses to look for malicious content may not clue into the ruse.

While MySpace profiles wont yield credit card numbers and bank accounts, and aren't the treasure troves that, say, online brokerage accounts are, they can be used to spread malicious code or to craft even more sophisticated spear phishing attacks later on.

MySpace has been informed of the attack but apparently hasn't gotten around to taking it down yet. Let's hope they do soon!