Loading story…
The SpyEye banking trojan was reported stealing online banking credentials and enabling fraudulent transactions while victims remained logged in, with newer variants designed to better evade bank fraud controls. Security reporting said the malware mimicked normal user behavior, including navigation patterns and transaction timing, to bypass behavioral detection systems, while also expanding its targeting to more financial institutions in additional countries and growing its command-and-control footprint.
Microsoft described Trojan:Win32/Spyeye as a credential-stealing malware family that captures keystrokes, performs form grabbing, exfiltrates stolen data to remote operators, downloads updates or arbitrary files, and uses rootkit-style techniques to hide its presence. Separate reporting showed SpyEye operators also added a "billinghammer" feature that automated fraudulent online purchases with stolen payment card data, routing transactions through infected machines near cardholders to reduce fraud alerts and turning compromised hosts into infrastructure for broader financial crime.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft documented Trojan:Win32/Spyeye as a credential-stealing trojan that captures keystrokes, performs form grabbing, exfiltrates data, downloads files, and uses rootkit techniques and API hooking to evade detection. The description also noted persistence via a Run registry key and that antivirus alerts may be the only visible symptom of infection.
Roman Hüssy of SpyEye Tracker said there were only about 20 active SpyEye command-and-control servers in May. This served as a baseline before later reported growth in the malware's infrastructure.
In April, authorities charged a 26-year-old Lithuanian and a 45-year-old Latvian for allegedly using SpyEye. The charges included conspiracy to cause unauthorized computer modifications, conspiracy to defraud, and concealing proceeds from crime; a third 26-year-old man was bailed pending further questioning.
SpyEye botnet kit added a module called "billinghammer" that automates fraudulent software purchases using stolen payment card data from infected victims. The feature was designed to help botmasters monetize stolen cards while evading anti-fraud checks by routing transactions through infected machines near the cardholder's location.
SpyEye Tracker reported that about 46 SpyEye command-and-control servers were online as of Tuesday, up from roughly 20 in May. Roman Hüssy said the increase showed SpyEye was growing significantly.
Trusteer reported that newer SpyEye versions included code intended to mimic normal banking-user behavior and evade banks' behavioral fraud-detection systems. The company also said SpyEye had expanded the number of financial institutions and countries it could target, indicating broader adoption by criminal groups.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
computerworld.com
Open sourcemicrosoft.com
Open sourcekrebsonsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Win32/Caphaw** banking trojan, also known as **Shylock**, targeted major European banks with a webinject plugin that altered online banking sessions in real time and enabled fraudulent transactions. Researchers said the malware had been active since at least 2011 and was especially prevalent in the **United Kingdom, Italy, Denmark, and Turkey**, with spread peaking in late 2012. Its webinjects could replace phone numbers shown on banking sites and use an **autoload** feature to initiate theft while victims were actively logged in, helping attackers bypass one-time-password protections. Caphaw combined several evasion and persistence techniques, including **process injection**, inter-process communication through **named pipes**, **anti-VM checks**, **polymorphic repacking**, and encrypted configuration delivery. The malware also supported a broad plugin ecosystem that expanded its capabilities beyond banking fraud, including **SOCKS proxying**, credential theft, **VNC** remote access, **Skype propagation**, removable-media spreading, video capture, and an **MBR bootkit** component tracked as **Win32/Wolcape**.
Aug 14, 2026
Researchers detailed **BackSwap**, a banking trojan linked to the **TinBa** malware family, that targeted online banking users by hiding inside trojanized legitimate Windows applications such as **7-Zip**, **FileZilla**, and **Notepad++**. First observed in 2018, the malware focused on Polish banks and later shifted heavily toward Spanish financial institutions, while also occasionally targeting cryptocurrency wallet users. Its operators used compromised legitimate websites as command-and-control infrastructure and repeatedly changed encryption keys, payload storage, and exfiltration methods to evade detection. BackSwap stood out for avoiding classic browser memory injection and instead manipulating browser sessions through Windows UI monitoring and simulated user actions. It delivered malicious JavaScript into active banking sessions, stole credentials, logged browser window titles and URLs, hijacked clipboard data, and replaced recipient account numbers to redirect transactions to attacker-controlled **IBANs**. Analysts said the malware stored XOR-obfuscated or encrypted web-injects in the `.rsrc` section, sometimes concealed shellcode in **BMP** images, and used position-independent code plus custom Windows API resolution to reduce its forensic footprint and bypass antivirus heuristics.
Aug 15, 2026
Researchers identified **Trojan-Banker.Win32.Chthonic** as a new ZeuS-family banking Trojan that evolved from the leaked ZeuS codebase and appears to borrow from **ZeusVM**, **Andromeda**, and **KINS**. The malware was observed targeting more than **150 banks** and **20 payment systems** across **15 countries**, with notable focus on institutions in the **UK, Spain, the US, Russia, Japan, and Italy**. Initial infections were linked to malicious email campaigns carrying crafted RTF files exploiting **`CVE-2014-1761`** in Microsoft Office, as well as delivery through the **Andromeda** botnet. Chthonic uses a modular architecture that extends beyond traditional banking fraud, combining **web injections**, **form grabbing**, **keylogging**, and **password theft** with **VNC-based remote access**, **SOCKS proxy** functionality, and even **webcam recording**. Its operators also employed layered obfuscation and custom loading methods, including **RC4**, **AES**, a virtual-machine-based configuration decryptor, and ZeuS-style non-PE modules mapped directly into memory, underscoring how the ZeuS lineage had matured into a flexible and stealthy criminal malware framework.
Aug 14, 2026