Loading story…
Attackers manipulated Google search results for banking- and finance-related queries to steer victims to malicious links that ultimately delivered the Zeus Panda banking trojan. The campaign relied on SEO poisoning and chains of compromised websites and intermediary redirectors, with victims served a malicious Microsoft Word document that used macros to download and execute a PE32 payload. Reported targeting focused on users seeking financial institutions and banking information, particularly in India and parts of the Middle East.
Once installed, Zeus Panda used multiple anti-analysis and anti-sandbox checks, including CIS-region keyboard locale detection, hypervisor and security-tool discovery, exception-based unpacking, and self-deletion behavior. The malware established persistence through a Windows Run registry key and copied itself into a Flash Player-themed directory under the victim’s roaming profile, while associated reporting tied the activity to broader Zeus Panda tradecraft and infrastructure including malicious domains, hashes, distribution URLs, and command-and-control servers.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Cisco Talos reported a malware distribution campaign that used search engine optimization poisoning to place malicious links in Google results for banking- and finance-related searches, ultimately delivering the Zeus Panda banking trojan via malicious Word documents and macros. The report also disclosed technical details of the infection chain, anti-analysis behavior, persistence mechanisms, and indicators of compromise tied to the campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 44 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tracked **Panda Banker**—also known as **PandaZeuS**, a Zeus-derived banking trojan—across multiple campaigns that used phishing, malvertising, and exploit-kit delivery to infect Windows users and steal credentials through **man-in-the-browser** webinjects. Reports documented active variants from `2.6.1` through `2.6.10`, including a Japanese campaign built around version `2.6.6` with 27 webinjects aimed largely at local banks and credit-card sites, as well as botnets and configs labeled **ank**, **Onore2**, **Cosmos3**, and `2.6.8`. Operators also altered Panda’s configuration encryption, apparently to hinder malware extractors and obscure controller infrastructure. Technical analyses showed Panda using staged JavaScript webinjects, backend-driven fraud workflows, screenshots, keylogging, clipboard theft, and VNC-related abuse to capture credentials and manipulate online banking sessions. The malware’s second-stage logic could identify login pages, exfiltrate victim data over HTTPS, display fake outage overlays, and guide victims into authorizing fraudulent transfers, effectively bypassing two-factor authentication through social engineering. By 2018, Panda had broadened beyond traditional financial targets to **cryptocurrency exchanges**, social media, email, ecommerce, entertainment, search, tech, and adult sites, while exposed administration panels and public config tracking highlighted a mature criminal operation with region-specific infrastructure tied to campaigns in Italy, Japan, the United States, and Latin America.
Aug 15, 2026
The **Gozi/Ursnif/ISFB** banking trojan remained an active cybercrime threat across Europe and Japan, spreading mainly through targeted malspam and phishing emails carrying weaponized Word, XLS, ZIP, JavaScript, HTA, and macro-enabled attachments. Multiple campaigns used staged infection chains involving VBA macros, PowerShell, `rundll32`, HTA downloaders, and side-loaded DLLs, with distribution tied in some cases to the **Dark Cloud** botnet and other spam infrastructure. Researchers also observed related delivery through Shiotob downloaders and compromised web servers, with operators rotating domains, IPs, and lure content to reduce detection while targeting both retail and corporate banking users.
Aug 15, 2026
Researchers identified **Trojan-Banker.Win32.Chthonic** as a new ZeuS-family banking Trojan that evolved from the leaked ZeuS codebase and appears to borrow from **ZeusVM**, **Andromeda**, and **KINS**. The malware was observed targeting more than **150 banks** and **20 payment systems** across **15 countries**, with notable focus on institutions in the **UK, Spain, the US, Russia, Japan, and Italy**. Initial infections were linked to malicious email campaigns carrying crafted RTF files exploiting **`CVE-2014-1761`** in Microsoft Office, as well as delivery through the **Andromeda** botnet. Chthonic uses a modular architecture that extends beyond traditional banking fraud, combining **web injections**, **form grabbing**, **keylogging**, and **password theft** with **VNC-based remote access**, **SOCKS proxy** functionality, and even **webcam recording**. Its operators also employed layered obfuscation and custom loading methods, including **RC4**, **AES**, a virtual-machine-based configuration decryptor, and ZeuS-style non-PE modules mapped directly into memory, underscoring how the ZeuS lineage had matured into a flexible and stealthy criminal malware framework.
Aug 14, 2026