Loading story…
A malware seller advertised Sphinx, a banking trojan derived from the leaked ZeuS source code, as a new crimeware offering on underground forums. The malware was written in C++ and promoted as operating entirely over the Tor network, with the seller claiming it was resistant to sinkholing, blacklisting, and traditional ZeuS tracking efforts associated with infrastructure-monitoring projects such as Zeus Tracker.
The offering included a broad set of banking-fraud features commonly associated with ZeuS-style malware, including form grabbing, webinjects, webfakes, keylogging, certificate theft, reverse SOCKS, and hidden VNC access to victim machines. Buyers were offered binaries for $500 each, payable in Bitcoin or DASH, with builds distributed through a buyer portal; despite its Tor-focused design, Sphinx reportedly retained a ZeuS-like PHP web panel and encrypted HTTP communications for botnet command and control.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
In August 2015, the Sphinx banking trojan, described as a new malware family derived from the ZeuS source code, was advertised for sale on the underground market. The seller promoted Tor-only operation, resistance to sinkholing and blacklisting, and priced the kit at $500 per binary with Bitcoin and DASH accepted.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **ZeuS** banking Trojan emerged as a dominant crimeware kit used to steal online banking credentials, browser-submitted form data, cookies, certificates, and files, while also enabling attackers to modify web pages, redirect victims, and execute arbitrary programs on infected systems. Reports describe ZeuS as a commercially sold toolkit priced around **$3,000–$4,000**, with add-on modules for capabilities such as backconnect access, VNC control, Firefox form grabbing, and Windows Vista/7 support. Its architecture evolved across the `1.2.x`, `1.3.x`, and `1.4.x` branches to add stronger encryption, web injects, API hooking, anti-analysis protections, random file names and mutexes, and RC4-encrypted communications with command-and-control servers, while commonly injecting into processes such as `winlogon.exe` or `explorer.exe`. The malware’s ecosystem also expanded into both competition and mobile fraud. SpyEye was marketed as a cheaper rival and introduced **"ZeusKiller"** to remove or hijack existing ZeuS infections, while ZeuS itself adopted hardware-based licensing and continued adding premium criminal features. A related mobile component, **ZeuS-in-the-Mobile (ZitMo)**, was used to intercept SMS-based transaction authentication numbers by tricking banking victims into installing fake mobile security software, allowing attackers to complete fraudulent transfers after harvesting credentials on the PC. More recent reporting also tied the **KINS** Zeus variant to a malvertising campaign targeting European transit users, where victims were redirected to malware disguised as a PDF, protections such as Windows Defender were weakened via registry changes, and the payload used characteristic POST traffic and inbound connectivity to maintain control.
Aug 15, 2026
Researchers identified **Trojan-Banker.Win32.Chthonic** as a new ZeuS-family banking Trojan that evolved from the leaked ZeuS codebase and appears to borrow from **ZeusVM**, **Andromeda**, and **KINS**. The malware was observed targeting more than **150 banks** and **20 payment systems** across **15 countries**, with notable focus on institutions in the **UK, Spain, the US, Russia, Japan, and Italy**. Initial infections were linked to malicious email campaigns carrying crafted RTF files exploiting **`CVE-2014-1761`** in Microsoft Office, as well as delivery through the **Andromeda** botnet. Chthonic uses a modular architecture that extends beyond traditional banking fraud, combining **web injections**, **form grabbing**, **keylogging**, and **password theft** with **VNC-based remote access**, **SOCKS proxy** functionality, and even **webcam recording**. Its operators also employed layered obfuscation and custom loading methods, including **RC4**, **AES**, a virtual-machine-based configuration decryptor, and ZeuS-style non-PE modules mapped directly into memory, underscoring how the ZeuS lineage had matured into a flexible and stealthy criminal malware framework.
Aug 14, 2026
**ICE IX** emerged as an early banking Trojan built from the leaked **ZeuS** source code, giving cybercriminals a ready-made platform for credential theft and botnet operations. Sold on underground forums for about **$1,800**, the malware used **HTTP**-based command-and-control through a web panel and targeted online banking sessions with browser hooking, web injects, and form grabbing. Reporting tied the threat to theft involving **Amazon EC2** data, while researchers warned that the ZeuS source leak would accelerate the creation of similar follow-on crimeware families. Technical analysis showed ICE IX largely reused ZeuS tradecraft rather than introducing major new capabilities. The malware employed **RC4**-protected communications, fake Google traffic to blend in, Windows registry persistence, and a self-deleting dropper, while also stealing credentials from browsers, FTP and mail clients, cookies, Flash `.sol` files, and certificates. Researchers found support for backconnect access, **SOCKS** proxying, **VNC**, screenshot capture, and certificate deletion, but concluded that many of the product's advertised enhancements—such as tracker resistance and stronger evasion—were overstated, amounting mostly to minor code changes and repackaging of existing ZeuS functionality.
Aug 15, 2026