Shiz

Shiz is a long-running banking Trojan family associated with financially motivated cybercrime and regarded as one of the older banking malware codebases still seen in the wild. It has been linked to the evolution of later banking malware, most notably Shifu, which is widely assessed as being derived from or representing a later evolution of the Shiz/iBank lineage with additional techniques influenced by Zeus.

Shiz has been observed in the Windows crimeware ecosystem as a payload distributed by other malware delivery operations, including Bredolab, and as a service or botnet resource used by criminal groups such as Carbanak. Its role in those ecosystems indicates use as a modular banking-focused payload rather than a standalone intrusion platform. Historical reporting also places Shiz among notable mobile and banking botnets active in the mid-2010s, though the strongest corroborated evidence in this context ties it to Windows-based banking Trojan activity.

The family is associated with credential theft from online banking users and with the broader banking Trojan tradecraft of intercepting or abusing financial sessions. Its code lineage influenced later malware that used multi-stage loading, process injection into legitimate Windows processes, persistence through user startup mechanisms, anti-analysis checks, API obfuscation, traffic interception, web-injection support, and command-and-control concealment. However, those latter implementation details are directly established for Shifu as a descendant or evolution of Shiz rather than for all Shiz variants themselves.

Shiz is notable in threat history both as an operational malware family used by cybercriminal partners and as a foundational codebase that informed subsequent banking Trojans. It sits within the broader ecosystem of financially motivated malware used against banking customers and financial institutions, especially in campaigns targeting online banking credentials on Microsoft Windows systems.