Saturday, April 20 2024

A banking trojan named Bizarro has expanded its attacks to target customers of 70 European and South American banks. The banking trojan, which originates in Brazil, is spread through phishing emails and affects Windows systems.

Researchers at Kaspersky Labs discovered the banking trojan. The group relies on affiliates and recruiting money mules to use social engineering to trick users into using fake two-factor identification codes. Bizzaro reaches users by sending spam emails with fake links to users, which distributes an MSI package.

The trojan then downloads a ZIP archive which contains the malicious code, and then Bizzaro eliminates any current online banking websites on the user’s device. This forces the user to re-enter their credentials which are then stolen by the malware. Bizarro focuses on gathering information such as the computer’s name, default browser name, and installed antivirus software name. The malware uses a screen capturing module to monitor the user’s screen for bitcoin wallet addresses constantly. This wallet is then replaced with one that belongs to the Bizarro malware developers.

Bizarro is rooted in its backdoor component, which supports over 100 commands and allows attackers to steal online banking credentials. These commands display fake popup messages to users but only becomes active once the malware finds a connection to one of the hardcoded banking systems. Bizarro receives many commands such as obtaining data about the user, allowing control of the files, mouse, and keyboard on the device, and commands that enable social engineering.

Bizarro uses social engineering by tricking the users into giving their bank account login credentials through message windows asking for login data or two-factor authentication. These messages provide the user with fake notifications asking to re-enter their credentials or asking for a confirmation code. These methods allow the malware to steal the user’s banking credentials swiftly and promptly. Bizarro also uses JPEG images with the target bank’s logo to convince the user that their system has been compromised and needs an update. Other malware such as Guildma, Javali, and Melcoz originate from Brazil just like Bizarro and target users all over Europe.

Previous

S&P Hints at Rating Downgrades for Poor Cyber… Again

Next

Cybersecurity M&A and Funding Update: May 28

Check Also

Widget

Don’t Miss

The words Endpoint Detection and Response (EDR) on a green background with lines on the right side of the image

Best Endpoint Detection & Response Platforms

Lara Oporto

Endpoint Detection & Response platforms continuously monitor endpoints for signs of malicious activities, such as unauthorized access or unusual behavior, enabling rapid detection and response to potential cyber threats to safeguard organizational assets. What is Endpoint Detection and Response and how does it work? Endpoint Detection and Response (EDR) is a cornerstone in modern cybersecurity […]

AT&T AlienVault Products Review: OSSIM vs USM

Ellie Buscemi

AlienVault is now the technological basis for AT&T AlienLabs and provides multiple products for different companies’ cybersecurity needs. What AT&T AlienVault Products are Available? In December 2021, CISOstack reported that AT&T intended to acquire AlienVault to expand its cybersecurity offerings to more businesses. Two years later, AlienVault-based offerings make up a large portion of AT&T’s […]

Photo by Simon Kadula on Unsplash.

Navigating Manufacturing IIoT Cybersecurity Challenges

John Powers

Guarding the Gears: Government policy and industry collaboration to mitigate cyberthreats to manufacturers. The smart factory is on the rise. Production lines equipped with advanced sensors can monitor equipment health in real-time and predict potential issues before they disrupt operations. Temperature and humidity sensors can ensure the optimal environment for delicate manufacturing processes. RFID-enabled asset […]

Best Microsegmentation Software

Ellie Buscemi

Microsegmentation allows a company to divide digital assets into smaller, more secure groups, which makes it harder for cybercriminals to take over a company’s data center. What is Microsegmentation? Microsegmentation refers to cyber professionals building layers of cybersecurity protection between groups of digital assets or individual cyber assets. Adding these layers inside instead of only […]

Best Breach and Attack Simulation Platforms

Ellie Buscemi

Breach and attack simulation (BAS) platforms allow companies to see weaknesses in their cyber infrastructures before a malicious hacker can exploit them. What Is BAS – Breach and Attack Simulation? Breach and attack simulation (BAS) is an approach to cybersecurity that uses advanced tools to imitate the attacks used by cybercriminals on companies’ digital infrastructure. […]

Ofer Ben-Noon and Ohad Bobrov

Palo Alto Networks to Acquire Talon

Ellie Buscemi

On Monday, Palo Alto Networks agreed to acquire Israeli startup Talon Cyber Security, an enterprise browser platform. The deal values Talon at between $600 to $700 million, according to The Information. Palo Alto will integrate Talon’s enterprise browser solution into its Prisma SASE product. The acquisition comes among a wave of acquisitions and releases involving […]