Cyber criminals send spam emails with links that look like bank login sites, but actually steal user's password information through man-in-the-browser attacks.