"Once being planted into the computer, the Trojan will not attack immediately but lurk until you decided to buy, then steal your money," said Li Qiushi, a senior manager from the Risk Management Department of Alipay.com, the payment platform of e-commerce giant Alibaba Group.
He issued the warning at the 2013 Internet Industry Security Forum in Beijing, China's state-run Xinhua News Agency reported.
"The phishing gangs become more and more professional and organized, with their technology more and more sophisticated," Li said.
Users should always double check the address of a website when they are shopping online and never leave their private information, such as ID card number and bank account record, on an unfamiliar website, experts warned.
In the second half of 2012, Alibaba and its partners blocked over 7 million cyber attacks from phishing websites, Li said.