I've received a recent security review of a website which mentioned it had a cross frame scripting vulnerability. In short, it mentioned that a malicious site could load the page up in an iframe, fooling the user to think the are on the legitimate page for the application, while overlaying controls and such to gather data and do other malicious activity. But I have also heard that an XFS is when an XSS attack is used to inject an iframe into your application pointing at a malicious site which then allows the malicious site loaded in the frame to gather data from those using your application as well as other malicious activities.
So, are these both cross frame scripting attacks because they both use iframes as a key element? Or is only the first attack an XFS while the second one is considered a version of XSS using iframes?
P.S. XSS and CSRF both have tags, is there a reason XFS doesn't?