Security firm Websense says it has noticed a sharp rise in spam e-mails from Yahoo, Gmail and Hotmail accounts.
This is because infected accounts are sending personalised e-mails to contacts suggesting shopping sites, which are in fact fakes.
Security expert Carl Leonard warned people to be on their guard.
He advised people to check with friends that they had indeed sent the recommendation before visiting any new shopping sites.
He also advised people to check web addresses: they should read https, with the 's' standing for secure.
The news reflects e-mails the BBC has received from victims.
Peter Griffin found his Hotmail account had been compromised on Tuesday. He is currently unemployed and is worried that he has been sending spam to prospective employers.
"I checked my account yesterday and found more than 10 e-mails with links [that] were sent from my Hotmail [account] to people from my contacts," he told the BBC.
Despite changing his password, he "found an hour later they had sent another six e-mails".
Key-logging
One security expert thinks victims of the scam could have been part of a so-called key-logging attack.
Amichai Shulman from security firm Imperva said the high numbers of victims suggested this type of attack.
Unlike a traditional phishing scam, which lures people into revealing their details on fake websites, key-logging records individual key strokes.
In some cases the malware could have been downloaded automatically.
The scam was highlighted when several lists, detailing more than 30,000 names and passwords from Hotmail, Google and Yahoo web mail accounts were posted online.
BBC News has seen two lists that detail more than 30,000 names and passwords from e-mail providers, including Yahoo and AOL, which were posted online.
Google is aware of a third list, although it is not clear how many names are on it.
The size of the scam has led Mr Shulman to question whether it is a traditional phishing attack.
Lists 'common'
"The vast majority of people do not fall prey to phishing attacks and the success rates are around one per 1,000. The fact that even one of these lists contained 10,000 names suggests to me that it was a key-logging scam," he said.
Key-logging malware can be downloaded from infected websites, of which Mr Shulman estimates there are millions in existence.
Once on a machine it can record every keystroke, including passwords or bank details.
The malware that installs a key-logger can be downloaded automatically although often it requires users to click a box, with common fakes promising system-enhancing or anti-virus software.
The lists, which were posted online at Pastebin, a website where developers share code, are not unusual, according to Mr Shulman.
"That's the nature of the world we live in and sometimes we get a glimpse inside it. These lists are constantly traded online," he said.
"The fact that the lists became public is probably negligence on the part of the hackers," he added.
According to a report published by MarkMonitor last week, phishing is at a two-year high.
It found that phishers were targeting payment websites and social networkers as well as traditional banking websites.
Experts are advising anyone who thinks they might have been affected by the scam to update their anti-virus software and to immediately change their passwords.
It has reopened the debate about how people manage the numerous passwords they have for various web accounts.
It has led one security expert to offer some unusual advice.
"People should write down their web based passwords. That's one way of making sure that you can remember a "strong" password," said Sean Sullivan, security advisor at F-Secure.
"This tends to go against the conventional wisdom but it just makes more sense. People use weak passwords because they cannot remember the strong ones."
BBC NEWS | Technology | Web mail scam propagates itself
This is because infected accounts are sending personalised e-mails to contacts suggesting shopping sites, which are in fact fakes.
Security expert Carl Leonard warned people to be on their guard.
He advised people to check with friends that they had indeed sent the recommendation before visiting any new shopping sites.
He also advised people to check web addresses: they should read https, with the 's' standing for secure.
The news reflects e-mails the BBC has received from victims.
Peter Griffin found his Hotmail account had been compromised on Tuesday. He is currently unemployed and is worried that he has been sending spam to prospective employers.
"I checked my account yesterday and found more than 10 e-mails with links [that] were sent from my Hotmail [account] to people from my contacts," he told the BBC.
Despite changing his password, he "found an hour later they had sent another six e-mails".
Key-logging
One security expert thinks victims of the scam could have been part of a so-called key-logging attack.
Amichai Shulman from security firm Imperva said the high numbers of victims suggested this type of attack.
Unlike a traditional phishing scam, which lures people into revealing their details on fake websites, key-logging records individual key strokes.
In some cases the malware could have been downloaded automatically.
The scam was highlighted when several lists, detailing more than 30,000 names and passwords from Hotmail, Google and Yahoo web mail accounts were posted online.
BBC News has seen two lists that detail more than 30,000 names and passwords from e-mail providers, including Yahoo and AOL, which were posted online.
Google is aware of a third list, although it is not clear how many names are on it.
The size of the scam has led Mr Shulman to question whether it is a traditional phishing attack.
Lists 'common'
"The vast majority of people do not fall prey to phishing attacks and the success rates are around one per 1,000. The fact that even one of these lists contained 10,000 names suggests to me that it was a key-logging scam," he said.
Key-logging malware can be downloaded from infected websites, of which Mr Shulman estimates there are millions in existence.
Once on a machine it can record every keystroke, including passwords or bank details.
The malware that installs a key-logger can be downloaded automatically although often it requires users to click a box, with common fakes promising system-enhancing or anti-virus software.
The lists, which were posted online at Pastebin, a website where developers share code, are not unusual, according to Mr Shulman.
"That's the nature of the world we live in and sometimes we get a glimpse inside it. These lists are constantly traded online," he said.
"The fact that the lists became public is probably negligence on the part of the hackers," he added.
According to a report published by MarkMonitor last week, phishing is at a two-year high.
It found that phishers were targeting payment websites and social networkers as well as traditional banking websites.
Experts are advising anyone who thinks they might have been affected by the scam to update their anti-virus software and to immediately change their passwords.
It has reopened the debate about how people manage the numerous passwords they have for various web accounts.
It has led one security expert to offer some unusual advice.
"People should write down their web based passwords. That's one way of making sure that you can remember a "strong" password," said Sean Sullivan, security advisor at F-Secure.
"This tends to go against the conventional wisdom but it just makes more sense. People use weak passwords because they cannot remember the strong ones."
BBC NEWS | Technology | Web mail scam propagates itself
