Loading story…
Researchers detailed renewed analysis of Tinba (also known as Tiny Banker or Zusy), a compact banking trojan built to steal credentials, browsing data, and financial information through man-in-the-browser techniques. The malware injects code into browser and system processes, targets Internet Explorer, Chrome, Firefox, and Opera, and uses webinjects and network sniffing to capture login sessions and abuse or bypass some two-factor authentication workflows. Reports also describe Tinba storing stolen data from banking, webmail, and social media sites, while dropping or using components such as bin.exe, cfg.dat, web.dat, and log.dat during infection.
The malware maintains persistence by copying itself into %APPDATA% and creating an auto-run registry entry, while using anti-debugging checks including IsDebuggerPresent to hinder analysis. Investigators said Tinba has been delivered through spam attachments, drive-by downloads, and the Angler Exploit Kit, and that it communicates with command-and-control infrastructure through DGA-generated fast-flux domains as well as hard-coded servers. Additional reporting linked Tinba infrastructure and traffic patterns to overlaps with Zeus and SpyEye, with observed indicators including suspected C2 domains, IP addresses, malware hashes, and an RC4-encoded HTTP POST pattern used during bot communications.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A Zscaler report analyzed a recent Tinba variant that used a custom packer, anti-debugging, persistence in %APPDATA%, browser injection, and DGA-based fast-flux command-and-control infrastructure. The report said Tinba had also been delivered through spam attachments and drive-by downloads, and that Angler Exploit Kit instances were observed serving the malware.
A June 2012 analysis documented Tinba, also known as Tiny Banker or Zusy, as a very small banking trojan that steals credentials via browser hooking, man-in-the-browser activity, webinjects, and network sniffing. The report also described its dropped files, process injection behavior, and suspected command-and-control domains and traffic patterns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 67 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **BackSwap**, a banking trojan linked to the **TinBa** malware family, that targeted online banking users by hiding inside trojanized legitimate Windows applications such as **7-Zip**, **FileZilla**, and **Notepad++**. First observed in 2018, the malware focused on Polish banks and later shifted heavily toward Spanish financial institutions, while also occasionally targeting cryptocurrency wallet users. Its operators used compromised legitimate websites as command-and-control infrastructure and repeatedly changed encryption keys, payload storage, and exfiltration methods to evade detection. BackSwap stood out for avoiding classic browser memory injection and instead manipulating browser sessions through Windows UI monitoring and simulated user actions. It delivered malicious JavaScript into active banking sessions, stole credentials, logged browser window titles and URLs, hijacked clipboard data, and replaced recipient account numbers to redirect transactions to attacker-controlled **IBANs**. Analysts said the malware stored XOR-obfuscated or encrypted web-injects in the `.rsrc` section, sometimes concealed shellcode in **BMP** images, and used position-independent code plus custom Windows API resolution to reduce its forensic footprint and bypass antivirus heuristics.
Aug 15, 2026
Researchers detailed **Zumanek**, a Brazilian banking malware family that uses a multi-stage infection chain to steal credentials from victims of online banking and cryptocurrency services. The malware was observed almost exclusively in Brazil and begins with a socially engineered downloader that verifies the system is configured for Brazilian Portuguese, checks for installed security products, retrieves a ZIP payload from its command-and-control infrastructure, and launches the final banker and remote-access trojan stage. The final payload abuses **DLL hijacking** by pairing a legitimate signed executable with a malicious DLL, then establishes persistence, injects into `notepad.exe`, and redirects targeted banking activity into Internet Explorer for credential theft through form grabbing. Zumanek communicates with its C2 over HTTP POST requests and multiple sockets, and supports a broad set of remote-control functions including screenshots, browser manipulation, and actions associated with keylogging, underscoring continued evolution in Brazilian financial malware.
Aug 14, 2026
Researchers detailed how the **Gootkit** banking trojan’s first-stage loader establishes persistence, evades analysis, and prepares browser-focused theft operations. The malware, a long-running **Node.js**-based threat associated with banking fraud, uses self-injection, multithreading, and runtime string decryption, then performs extensive sandbox and virtual-machine checks against filenames, environment variables, CPU identifiers, MAC prefixes, loaded modules, usernames, computer names, and BIOS-related registry values. If it detects an analysis environment, Gootkit may delete itself or sleep indefinitely; otherwise, it continues to persistence and payload retrieval. The loader stores encrypted configuration data, recovers command-and-control settings with a simple XOR routine, and can persist either by creating a randomly named Windows service under `%SystemRoot%` or by abusing **IEAK PendingGPOs** so `explorer.exe` launches it without administrator rights. It also acts as an updater, sending host metadata to C2 servers over HTTP, downloading replacement executables, disabling Internet Explorer Protected Mode, and injecting decrypted x86 and x64 DLLs into browser processes via section mapping APIs. Separate reporting on a misconfigured Gootkit C2 server showed operators targeting mainly German and French bank customers with web injects, stolen-data parsers, and fraud-enabling notifications, while Microsoft published hunting guidance linking likely delivery and C2 activity to alerts involving `wscript.exe`, ZIP files, and JavaScript execution.
Aug 15, 2026