QUOTE
Websense® Security Labs™ has received reports of a Trojan Horse that...monitors Microsoft® Internet Explorer and waits for the user to visit one of a dozen financial websites. Once the user begins the logon process, the Trojan creates a pop-up window to replace the actual logon page...Account information entered into these pop-up windows is captured and emailed to the attacker.

websensesecuritylabs.com