An official EA Games server has been attacked by hackers -- and now hosts an incredibly realistic "phishing" site to try and collect user names and passwords.
The compromised server on EA.com hosts a site which looks just like an official iTunes Apple ID sign-in page.
But the domain is not owned by Apple, and the page is not operated by EA. Instead, anyone putting their details into the page will be in for a shock: their details will not go to either company, but straight into the hands of hackers.
The phishing site also asks those duped by its appearance to enter their full credit card details, date of birth and other security information.
EA has said it is investigating, and would try to pull the page from its server.
"Privacy and security are of the utmost importance to us, and we are currently investigating this report," it said in a statement.
It is thought the hack originated from a flaw in an online calendar application.
Researchers at Netcraft wrote:
"In this case, the hacker has managed to install and execute arbitrary PHP scripts on the EA server, so it is likely that he can at least also view the contents of the calendar and some of the source code and other data present on the server.
The mere presence of old software can often provide sufficient incentive for a hacker to target one system over another, and to spend more time looking for additional vulnerabilities or trying to probe deeper into the internal network."