Loading story…
The Retefe banking Trojan was used in phishing campaigns targeting organizations in Sweden, Switzerland, and Japan, where it intercepted online banking sessions by installing a rogue root certificate and changing proxy settings to route traffic through attacker-controlled infrastructure. Rather than relying on traditional browser hooking alone, the malware used PowerShell to enable man-in-the-middle interception of financial traffic, and infections also deployed Smoke Loader as a secondary payload for credential theft and additional malware delivery.
Technical analysis of later Retefe variants showed the malware’s embedded JavaScript payload was hidden in the PE file’s .data segment and decoded with a 4-byte XOR key derived from the script length and arithmetic operations. Researchers documented an unpacking workflow that used YARA to locate decoding parameters, calculate the buffer RVA, derive the XOR array, and recover the script, highlighting how the malware’s packing and storage methods evolved from earlier variants while preserving its banking-focused intrusion model.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
A technical writeup published on 2018-12-28 explained how to statically unpack current Retefe banking malware samples using YARA-derived parameters to locate, extract, and decode the embedded script. The author also released source code for the unpacker and confirmed it worked on three listed sample hashes.
A prior post titled "Reversing Retefe" documented a Retefe variant that protected its payload with a one-byte XOR key. The later unpacker writeup cites this as evidence of an earlier implementation before subsequent code changes.
The 2018 unpacker writeup states that contemporary Retefe samples stored their JavaScript payload in the .data segment and decoded it with a 4-byte XOR key derived from the script length and mathematical operations. The author inferred the threat actor had changed its code base from the variant described in the November 2018 reversing post.
The 2015 research detailed that Retefe used PowerShell to install a rogue root certificate and change proxy settings so traffic to targeted banks was routed through attacker-controlled infrastructure for man-in-the-middle interception. The same campaign also downloaded Smoke Loader as additional malware.
Palo Alto Networks reported a recent two-week surge of phishing emails delivering the Retefe banking Trojan to organizations in Western Europe and Japan. The campaign used localized order and receipt lures and targeted banking users in Sweden, Switzerland, and Japan.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
govcert.admin.ch
Open sourcegithub.com
Open sourcegithub.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported a renewed **Retefe** banking Trojan campaign targeting online banking users in Switzerland, Germany, and Liechtenstein, with operators shifting tactics to improve stealth and credential theft. Rather than relying mainly on web injects, Retefe redirected victim banking traffic through a proxy, and in one observed Switzerland-focused campaign an **OLE-based lure document** delivered **Smoke Loader**, which then fetched the banking malware. Researchers also noted infrastructure and tooling changes, including the replacement of **Tor** with **stunnel** for encrypted tunneling and the use of a shareware application, **Convert PDF to Word Plus 1.0**, in the infection chain. The campaign also expanded its reach to **macOS** users by distributing fake Adobe installer applications signed with a developer certificate, a technique designed to help the malware pass Apple **Gatekeeper** checks and appear trustworthy when opened on a Mac. The activity showed that Retefe operators were actively refining cross-platform delivery, downloader selection, and trust-abuse methods to sustain banking credential theft against regional financial institutions and their customers.
Aug 14, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers reported multiple **Remcos RAT** campaigns using phishing emails and trusted infrastructure to infect victims while evading detection. In one intrusion chain, a ZIP attachment named `MV MERKET COOPER SPECIFICATION.zip` delivered an obfuscated JavaScript file that fetched a PowerShell loader from `almacensantangel[.]com`; the loader then reconstructed and decrypted payloads in memory, including `ALTERNATE.dll` and `Cqeqpvzeia.exe`. The malware injected into the legitimate Microsoft .NET utility `aspnet_compiler.exe`, communicated with `192[.]3[.]27[.]141:8087`, and stored captured keystrokes and other data in `C:\ProgramData\remcos\logs.dat`, leaving few disk artifacts. A separate campaign used phishing emails that linked to a fake Google Drive sharing page hosted through **Google Cloud Storage** and the trusted `googleapis.com` domain, helping the attack bypass email and web filtering. After user interaction, the infection chain used staged JavaScript redirects or downloads, followed by VBScript or PowerShell execution to retrieve the final Remcos payload, which was then injected into a legitimate Windows process through **process hollowing**, persisted via Windows Registry entries, and opened encrypted command-and-control channels. The activity underscores how attackers are combining living-off-the-land techniques, trusted cloud services, obfuscated scripting, and legitimate Windows binaries to deploy Remcos for surveillance and data theft.
Jun 29, 2026