Loading story…
Researchers detailed BackSwap, a banking trojan linked to the TinBa malware family, that targeted online banking users by hiding inside trojanized legitimate Windows applications such as 7-Zip, FileZilla, and Notepad++. First observed in 2018, the malware focused on Polish banks and later shifted heavily toward Spanish financial institutions, while also occasionally targeting cryptocurrency wallet users. Its operators used compromised legitimate websites as command-and-control infrastructure and repeatedly changed encryption keys, payload storage, and exfiltration methods to evade detection.
BackSwap stood out for avoiding classic browser memory injection and instead manipulating browser sessions through Windows UI monitoring and simulated user actions. It delivered malicious JavaScript into active banking sessions, stole credentials, logged browser window titles and URLs, hijacked clipboard data, and replaced recipient account numbers to redirect transactions to attacker-controlled IBANs. Analysts said the malware stored XOR-obfuscated or encrypted web-injects in the .rsrc section, sometimes concealed shellcode in BMP images, and used position-independent code plus custom Windows API resolution to reduce its forensic footprint and bypass antivirus heuristics.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
In August 2018, BackSwap began storing multiple web-injects in a single resource separated by markers such as [start:] and [fartu:]. Later samples added further separators including [mumuo:], [pghtyq], [tempo:], [code:], [joke:], and [asap:].
In June 2018, F5 Labs documented that BackSwap performed banking fraud locally in the browser by injecting JavaScript from its PE resources, cloning visible beneficiary fields, hiding the originals, and submitting attacker-controlled account details instead. The report also noted newer samples had renamed resource sections and began obfuscating the fraudster IBAN with a switch-based decoding routine.
In June 2018, BackSwap introduced a technique that encrypted its position-independent payload and embedded it inside BMP images. The malware used BMP headers as valid x86 instruction bytes to help disguise the shellcode.
In May 2018, BackSwap samples changed their web-inject resource encryption keys repeatedly, including multiple distinct single-byte XOR keys. During the same month, the malware used HTTP requests to yadro.ru to track the number of infected machines.
In April 2018, some BackSwap samples were configured to target up to six banks within a single binary. This marked an expansion beyond narrower earlier targeting.
BackSwap was first observed around March 2018 as a banking trojan targeting Polish online banking users. Early samples mainly targeted Polish banking sites including ipko.pl, 24.pl, and mbank.pl.
By late 2018, analysis showed BackSwap had shifted from initially targeting banks in Poland to focusing almost entirely on banks in Spain. The report also documented repeated changes in web-inject delivery and exfiltration methods across 2018.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
cert.pl
Open sourceresearch.checkpoint.com
Open sourcef5.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed renewed analysis of **Tinba** (also known as **Tiny Banker** or **Zusy**), a compact banking trojan built to steal credentials, browsing data, and financial information through **man-in-the-browser** techniques. The malware injects code into browser and system processes, targets **Internet Explorer, Chrome, Firefox, and Opera**, and uses webinjects and network sniffing to capture login sessions and abuse or bypass some two-factor authentication workflows. Reports also describe Tinba storing stolen data from banking, webmail, and social media sites, while dropping or using components such as `bin.exe`, `cfg.dat`, `web.dat`, and `log.dat` during infection. The malware maintains persistence by copying itself into **`%APPDATA%`** and creating an auto-run registry entry, while using anti-debugging checks including **`IsDebuggerPresent`** to hinder analysis. Investigators said Tinba has been delivered through spam attachments, drive-by downloads, and the **Angler Exploit Kit**, and that it communicates with command-and-control infrastructure through **DGA-generated fast-flux domains** as well as hard-coded servers. Additional reporting linked Tinba infrastructure and traffic patterns to overlaps with **Zeus** and **SpyEye**, with observed indicators including suspected C2 domains, IP addresses, malware hashes, and an RC4-encoded HTTP POST pattern used during bot communications.
Aug 15, 2026
The **Bizarro** banking Trojan, long associated with Brazilian cybercrime, expanded its operations to victims in **Spain, Portugal, France, Italy, Germany, Argentina, Chile, and Brazil**, broadening a campaign focused on stealing online banking credentials and enabling fraud. Researchers said the malware was delivered through spam emails that pushed victims to download **MSI installers**, which then retrieved additional payloads from compromised websites, hacked WordPress servers, and cloud-hosted infrastructure on **Azure** and **AWS**. Once installed, Bizarro used heavy obfuscation and a backdoor supporting more than **100 commands** to disrupt browser sessions, capture screens, log keystrokes, and hijack clipboard data. The operators also relied heavily on social engineering, displaying fake banking pop-ups, bogus security-update prompts, and requests for **two-factor authentication** codes, while also using malicious **QR codes** that could redirect victims to Android malware to extend the fraud chain beyond desktop systems.
Aug 14, 2026
The **Win32/Caphaw** banking trojan, also known as **Shylock**, targeted major European banks with a webinject plugin that altered online banking sessions in real time and enabled fraudulent transactions. Researchers said the malware had been active since at least 2011 and was especially prevalent in the **United Kingdom, Italy, Denmark, and Turkey**, with spread peaking in late 2012. Its webinjects could replace phone numbers shown on banking sites and use an **autoload** feature to initiate theft while victims were actively logged in, helping attackers bypass one-time-password protections. Caphaw combined several evasion and persistence techniques, including **process injection**, inter-process communication through **named pipes**, **anti-VM checks**, **polymorphic repacking**, and encrypted configuration delivery. The malware also supported a broad plugin ecosystem that expanded its capabilities beyond banking fraud, including **SOCKS proxying**, credential theft, **VNC** remote access, **Skype propagation**, removable-media spreading, video capture, and an **MBR bootkit** component tracked as **Win32/Wolcape**.
Aug 14, 2026