Loading story…
URLZone, also known as Bebloh, operated as a man-in-the-browser banking trojan that intercepted online banking sessions, manipulated browser content, and concealed fraudulent activity from victims. Researchers reported that the malware altered balances and transaction views to make fake transfers appear legitimate, including scams in which victims were told an erroneous credit had been deposited and that their account would remain frozen until the money was returned to an attacker-controlled account. The campaign relied on web-inject techniques similar to other banking malware, but URLZone stood out for hiding unauthorized transfers directly inside the victim’s banking session.
The malware was commonly delivered through spam attachments posing as DHL notices, holiday bookings, or fake flight information, then injected code into Windows processes such as iexplore.exe, explorer.exe, svchost.exe, and winlogon.exe. Analysts said it used a centralized but frequently changing command-and-control infrastructure, encrypted configuration data with layered encoding and XXTEA, and maintained persistence through techniques including userinit.exe hijacking and later a stealthier method that injected into explorer.exe, deleted its on-disk executable, and recreated itself at shutdown via a randomly named .lnk autostart entry. Those changes improved antivirus evasion while preserving the trojan’s core role of stealing banking credentials and facilitating account fraud.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The first known URLZone variant dates back to September 2009. URLZone, also known as Bebloh, was identified as a man-in-the-browser banking trojan.
An updated Bebloh variant introduced a technique in which it injected into explorer.exe, deleted its original executable, and stayed largely absent from disk and the registry during normal runtime. On shutdown-related Windows messages, it wrote itself back to disk and created persistence via a randomly named .lnk autostart entry.
G Data reported that Bebloh infections had risen significantly in recent months and that the malware ranked among the top three banking trojans in November. The newer variant was distributed through spam emails with fake flight information attachments.
Germany’s Federal Criminal Police (BKA) warned consumers about a Windows banking malware strain that waited for victims to log in, then claimed an erroneous credit had been deposited and that the account was frozen until the money was returned. The malware altered displayed balances and presented a pre-filled transfer form to send funds to attacker-controlled accounts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
gdatasoftware.com
Open sourcevirusbulletin.com
Open sourcekrebsonsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Zumanek**, a Brazilian banking malware family that uses a multi-stage infection chain to steal credentials from victims of online banking and cryptocurrency services. The malware was observed almost exclusively in Brazil and begins with a socially engineered downloader that verifies the system is configured for Brazilian Portuguese, checks for installed security products, retrieves a ZIP payload from its command-and-control infrastructure, and launches the final banker and remote-access trojan stage. The final payload abuses **DLL hijacking** by pairing a legitimate signed executable with a malicious DLL, then establishes persistence, injects into `notepad.exe`, and redirects targeted banking activity into Internet Explorer for credential theft through form grabbing. Zumanek communicates with its C2 over HTTP POST requests and multiple sockets, and supports a broad set of remote-control functions including screenshots, browser manipulation, and actions associated with keylogging, underscoring continued evolution in Brazilian financial malware.
Aug 14, 2026
Researchers identified **Trojan-Banker.Win32.Chthonic** as a new ZeuS-family banking Trojan that evolved from the leaked ZeuS codebase and appears to borrow from **ZeusVM**, **Andromeda**, and **KINS**. The malware was observed targeting more than **150 banks** and **20 payment systems** across **15 countries**, with notable focus on institutions in the **UK, Spain, the US, Russia, Japan, and Italy**. Initial infections were linked to malicious email campaigns carrying crafted RTF files exploiting **`CVE-2014-1761`** in Microsoft Office, as well as delivery through the **Andromeda** botnet. Chthonic uses a modular architecture that extends beyond traditional banking fraud, combining **web injections**, **form grabbing**, **keylogging**, and **password theft** with **VNC-based remote access**, **SOCKS proxy** functionality, and even **webcam recording**. Its operators also employed layered obfuscation and custom loading methods, including **RC4**, **AES**, a virtual-machine-based configuration decryptor, and ZeuS-style non-PE modules mapped directly into memory, underscoring how the ZeuS lineage had matured into a flexible and stealthy criminal malware framework.
Aug 14, 2026
Researchers tied the **DELoader** malware family targeting German-speaking users to the later **Zloader**/**Zeus Sphinx** banking trojan, showing how an early loader evolved into a broader modular crimeware platform. Fortinet found DELoader creating a suspended `explorer.exe`, decrypting and injecting an embedded DLL, then downloading and validating an additional PE payload from command-and-control infrastructure. Exposed victim logs and code strings indicated infections concentrated in **Germany and Austria**, while domain registration details overlapped with infrastructure previously associated with **Zeus** and **Marcher** banking malware campaigns. Later reverse engineering showed Zloader using layered obfuscation, process injection, encrypted configuration data, and a **domain generation algorithm (DGA)** that produces 20-character `.com` fallback domains from date-based seeds and embedded RC4 keys. Avast described **Zloader 2 / Silent Night** as a modular banking malware platform capable of credential theft, web injects, keylogging, screenshot capture, VNC-style remote control, cryptocurrency wallet theft, and delivery of additional payloads, with distribution through spam, fake installers, and malicious websites. Investigators also linked Zloader operations to other malware ecosystems including **Raccoon Stealer** and **Ursnif**, and noted that its botnet infrastructure became the subject of a joint **Microsoft-led takedown** effort.
Aug 15, 2026