It's a new, dastardly twist on an old scam. Crooks have long used harvested addresses in the 'From:' field on junk e-mail to make messages look realistic. But because anti­spam measures have been getting better at blocking such spoofed spam, the bad guys are now breaking in and sending e-mail from actual accounts.

Maureen Arnold, a former CPA in Apache Junction, Arizona, was hit by such an attack. When she checked her MSN mail one day, she found several warnings about undeliverable messages sent from her account that she hadn't written, along with messages in her Sent box. The scam e-mail--touting a site selling electronic products--went out to her family and friends. Similar attacks have asked recipients to wire money to a particular account; some have even deleted an account's contact list afterward.

The attacks underscore an oft-ignored fact: Webmail accounts are a major target because they have value. A recent report by the Anti-Phishing Working Group says the most common types of log-ins stolen by keylogger malware are for financial Web sites, e-commerce sites, and Webmail. In addition to hijacking an e-mail account to send out messages, crooks can often glean information that helps them break into a victim's financial accounts.

So how do you keep your valuable Webmail account safe? The first step, of course, is to keep your PC clean of malware. But that isn't a complete solution: Maureen Arnold checked her PC with mul­­tiple security scanners after she discovered the break-in, and found nothing.

Another important step is to as­­sume that any public or borrowed computer that you've used to check your Webmail account was infected with a keylogger, and that your account log-in was stolen. Change your password as soon as you can on a trusted, secure computer.

Web security expert Jeremiah Grossman of WhiteHat Security identifies another point of entry: Crooks often lift Webmail account details after breaking into other sites. Many sites require your e-mail address for logging in, and many people use the same password, as well, for their log-ins to different sites.