Loading story…
The Win32/Caphaw banking trojan, also known as Shylock, targeted major European banks with a webinject plugin that altered online banking sessions in real time and enabled fraudulent transactions. Researchers said the malware had been active since at least 2011 and was especially prevalent in the United Kingdom, Italy, Denmark, and Turkey, with spread peaking in late 2012. Its webinjects could replace phone numbers shown on banking sites and use an autoload feature to initiate theft while victims were actively logged in, helping attackers bypass one-time-password protections.
Caphaw combined several evasion and persistence techniques, including process injection, inter-process communication through named pipes, anti-VM checks, polymorphic repacking, and encrypted configuration delivery. The malware also supported a broad plugin ecosystem that expanded its capabilities beyond banking fraud, including SOCKS proxying, credential theft, VNC remote access, Skype propagation, removable-media spreading, video capture, and an MBR bootkit component tracked as Win32/Wolcape.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
ESET published an analysis describing how Caphaw used a webinject plugin against major European banks, including phone-number substitution and autoload functionality to steal money during active online banking sessions. The report also detailed its evasion methods, plugin architecture, and optional MBR bootkit component.
Aleksandr Matrosov began closely tracking Caphaw in early 2013. His analysis contributed to documenting the malware's capabilities, including webinject-based banking fraud.
ESET detection statistics showed Caphaw spreading most actively during the last months of 2012. This marked a period of heightened malware prevalence across affected regions.
Win32/Caphaw, also known as Shylock, had been spreading since at least fall 2011 and targeted major European banks. The malware was especially prevalent in the United Kingdom, Italy, Denmark, and Turkey.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **Caphaw** (also known as **Shylock**) as a banking trojan that evolved into a mature botnet platform capable of credential theft, browser injection, and broader post-compromise activity. Active since 2011, the malware targeted online banking users at at least **24 financial institutions**, primarily in Europe with some U.S. banks also affected. Analysts linked infections to likely exploit-kit delivery against vulnerable Java installations and found the malware establishing persistence through registry autorun entries, modifying Internet Explorer settings, and injecting into processes such as `explorer.exe`, `iexplore.exe`, and other browsers to monitor sessions and steal credentials through man-in-the-browser techniques. Technical analysis showed Caphaw using layered evasion and resilient command-and-control methods, including **anti-VM**, **anti-debugging**, **domain generation algorithms**, and **RC4-encrypted traffic over SSL** with self-signed certificates. Its plug-in architecture enabled operators to extend functionality beyond banking theft to include **VNC access, Skype and disk spreading, cookie theft, and SOCKS proxying**, while host reconnaissance and code injection made removal more difficult. Researchers assessed the malware as a dangerous, long-lived threat because it combined financial fraud with modular capabilities suited for deeper network infiltration and persistent botnet operations.
Aug 14, 2026
Researchers identified **Trojan-Banker.Win32.Chthonic** as a new ZeuS-family banking Trojan that evolved from the leaked ZeuS codebase and appears to borrow from **ZeusVM**, **Andromeda**, and **KINS**. The malware was observed targeting more than **150 banks** and **20 payment systems** across **15 countries**, with notable focus on institutions in the **UK, Spain, the US, Russia, Japan, and Italy**. Initial infections were linked to malicious email campaigns carrying crafted RTF files exploiting **`CVE-2014-1761`** in Microsoft Office, as well as delivery through the **Andromeda** botnet. Chthonic uses a modular architecture that extends beyond traditional banking fraud, combining **web injections**, **form grabbing**, **keylogging**, and **password theft** with **VNC-based remote access**, **SOCKS proxy** functionality, and even **webcam recording**. Its operators also employed layered obfuscation and custom loading methods, including **RC4**, **AES**, a virtual-machine-based configuration decryptor, and ZeuS-style non-PE modules mapped directly into memory, underscoring how the ZeuS lineage had matured into a flexible and stealthy criminal malware framework.
Aug 14, 2026
Researchers reported that the **Coyote** banking trojan is actively targeting users, primarily in Brazil, through a multi-stage infection chain that begins with malicious Windows `.lnk` shortcut files. The shortcuts launch PowerShell, which in turn deploys shellcode, performs DLL-based process injection, and uses Donut-assisted payload execution before installing a final MSIL payload with registry-based persistence. Once running, Coyote conducts anti-analysis checks, fingerprints the host, communicates with command-and-control infrastructure over port `443`, and supports a broad set of capabilities including keylogging, screenshots, phishing overlays, clipboard abuse, window manipulation, remote control actions, and system shutdown.
Aug 15, 2026