Loading story…
Researchers documented Caphaw (also known as Shylock) as a banking trojan that evolved into a mature botnet platform capable of credential theft, browser injection, and broader post-compromise activity. Active since 2011, the malware targeted online banking users at at least 24 financial institutions, primarily in Europe with some U.S. banks also affected. Analysts linked infections to likely exploit-kit delivery against vulnerable Java installations and found the malware establishing persistence through registry autorun entries, modifying Internet Explorer settings, and injecting into processes such as explorer.exe, iexplore.exe, and other browsers to monitor sessions and steal credentials through man-in-the-browser techniques.
Technical analysis showed Caphaw using layered evasion and resilient command-and-control methods, including anti-VM, anti-debugging, domain generation algorithms, and RC4-encrypted traffic over SSL with self-signed certificates. Its plug-in architecture enabled operators to extend functionality beyond banking theft to include VNC access, Skype and disk spreading, cookie theft, and SOCKS proxying, while host reconnaissance and code injection made removal more difficult. Researchers assessed the malware as a dangerous, long-lived threat because it combined financial fraud with modular capabilities suited for deeper network infiltration and persistent botnet operations.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Fortinet's analysis says version 1.7.x marked a period of structural stability for Caphaw beginning in February 2013. The malware had matured from its earlier builds into a more stable platform by that point.
Fortinet researchers reported that their team first received a sample of the Caphaw malware family, also known as Shylock, in late October 2011. This marks the earliest explicitly anchored event in the references.
The references state that Caphaw has targeted users' bank accounts since 2011 and operated as a persistent botnet malware family from that year. This establishes the start of the malware family's observed activity.
Zscaler ThreatLabZ reported a recent increase in Caphaw infections over the prior month, tying the activity to credential monitoring at 24 financial institutions, mainly in Europe with some U.S. banks also affected. The report also noted low antivirus detection and suspected exploit-kit delivery via vulnerable Java installations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 34 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
abuse.ch
Open sourcevirusbulletin.com
Open sourcezscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Win32/Caphaw** banking trojan, also known as **Shylock**, targeted major European banks with a webinject plugin that altered online banking sessions in real time and enabled fraudulent transactions. Researchers said the malware had been active since at least 2011 and was especially prevalent in the **United Kingdom, Italy, Denmark, and Turkey**, with spread peaking in late 2012. Its webinjects could replace phone numbers shown on banking sites and use an **autoload** feature to initiate theft while victims were actively logged in, helping attackers bypass one-time-password protections. Caphaw combined several evasion and persistence techniques, including **process injection**, inter-process communication through **named pipes**, **anti-VM checks**, **polymorphic repacking**, and encrypted configuration delivery. The malware also supported a broad plugin ecosystem that expanded its capabilities beyond banking fraud, including **SOCKS proxying**, credential theft, **VNC** remote access, **Skype propagation**, removable-media spreading, video capture, and an **MBR bootkit** component tracked as **Win32/Wolcape**.
Aug 14, 2026
Researchers identified **Trojan-Banker.Win32.Chthonic** as a new ZeuS-family banking Trojan that evolved from the leaked ZeuS codebase and appears to borrow from **ZeusVM**, **Andromeda**, and **KINS**. The malware was observed targeting more than **150 banks** and **20 payment systems** across **15 countries**, with notable focus on institutions in the **UK, Spain, the US, Russia, Japan, and Italy**. Initial infections were linked to malicious email campaigns carrying crafted RTF files exploiting **`CVE-2014-1761`** in Microsoft Office, as well as delivery through the **Andromeda** botnet. Chthonic uses a modular architecture that extends beyond traditional banking fraud, combining **web injections**, **form grabbing**, **keylogging**, and **password theft** with **VNC-based remote access**, **SOCKS proxy** functionality, and even **webcam recording**. Its operators also employed layered obfuscation and custom loading methods, including **RC4**, **AES**, a virtual-machine-based configuration decryptor, and ZeuS-style non-PE modules mapped directly into memory, underscoring how the ZeuS lineage had matured into a flexible and stealthy criminal malware framework.
Aug 14, 2026
Researchers detailed how the **Gootkit** banking trojan’s first-stage loader establishes persistence, evades analysis, and prepares browser-focused theft operations. The malware, a long-running **Node.js**-based threat associated with banking fraud, uses self-injection, multithreading, and runtime string decryption, then performs extensive sandbox and virtual-machine checks against filenames, environment variables, CPU identifiers, MAC prefixes, loaded modules, usernames, computer names, and BIOS-related registry values. If it detects an analysis environment, Gootkit may delete itself or sleep indefinitely; otherwise, it continues to persistence and payload retrieval. The loader stores encrypted configuration data, recovers command-and-control settings with a simple XOR routine, and can persist either by creating a randomly named Windows service under `%SystemRoot%` or by abusing **IEAK PendingGPOs** so `explorer.exe` launches it without administrator rights. It also acts as an updater, sending host metadata to C2 servers over HTTP, downloading replacement executables, disabling Internet Explorer Protected Mode, and injecting decrypted x86 and x64 DLLs into browser processes via section mapping APIs. Separate reporting on a misconfigured Gootkit C2 server showed operators targeting mainly German and French bank customers with web injects, stolen-data parsers, and fraud-enabling notifications, while Microsoft published hunting guidance linking likely delivery and C2 activity to alerts involving `wscript.exe`, ZIP files, and JavaScript execution.
Aug 15, 2026