Kaspersky Lab researchers have detected new malware which has been designed to steal the credentials of online banking customers. Earlier versions of the Trojan were known to the security industry as TinyNuke, but lacked the features necessary to launch attacks. The latest versions however, referred to as NukeBot, are fully operable and contain code to target the users of specific banks.
Kaspersky are concerned that criminals have a ready-to-attack version of the Trojan, as they fear it shows signs of a potential wide-scale malicious campaign, to infect multiple users.
NukeBot is a banking Trojan and upon infection it “injects” malicious code into the webpage of an online banking service displayed in a victim’s browser and then steals user data and spoofs their credentials.
There are already a number of compiled samples of this Trojan shared on underground hacking forums says Kaspersky. While most of these are rough, barely operational malware drafts; the firm believes there are some more developed versions out there that could be a real threat.
Around 5% of all samples found by Kaspersky Lab were NukeBot’s new ‘combat versions’, which have improved source codes and attacking capacities. Among other things these versions contain injections – specific pieces of code, which mimic parts of user interface of real online banking services. Based on the analysis of injections, Kaspersky believe the main targets of the new version of NukeBot are users of several French and US banks.
In addition, Kaspersky Lab researchers managed to detect several NukeBot modifications that didn’t have web injection functionality, and were designed to steal mail client and browser passwords. This means that developers of new versions may aim to widen the functionality of this malware family.
“While criminals behind recent versions of this malware currently are not actively distributing NukeBot, this may, and likely will, change very soon. We’ve already seen this before with some other malware families: after a short testing period of a ready-to-attack malware, criminals start distributing it widely through infected websites, spam and phishing. So far we have seen NukeBot versions which are ready to attack the customers of at least six banks located in France and the US, however this list of targets looks like only the beginning. The goal of our brief research is to warn the banking community and online banking customers about a potentially emerging threat. We urge interested parties to use the results of our research in order to protect themselves from this threat in advance,” said Sergey Yunakovsky, security expert at Kaspersky Lab.