This new malware uses remote overlay attacks to hijack your bank account

guest · Oct 19, 2020

This new malware uses remote overlay attacks to hijack your bank account
Vizom disguises itself as popular videoconferencing software many of us are relying on during the pandemic
October 19, 2020
https://www.zdnet.com/article/this-...-overlay-attacks-to-hijack-your-bank-account/

Researchers have uncovered a new form of malware using remote overlay attacks to strike Brazilian bank account holders.
The new malware variant, dubbed Vizom by IBM, is being utilized in an active campaign across Brazil designed to compromise bank accounts via online financial services.

On Tuesday, IBM security researchers Chen Nahman, Ofir Ozer, and Limor Kessem said the malware uses interesting tactics to stay hidden and to compromise user devices in real-time -- namely, remote overlay techniques and DLL hijacking.
Click to expand...

Once the malware has landed on a vulnerable Windows PC, Vizom will first strike the AppData directory to begin the infection chain. By harnessing DLL hijacking, the malware will attempt to force the loading of malicious DLLs by naming its own Delphi-based variants with names expected by the legitimate software in their directories.

In order to create convincing overlays, the malware generates HTML files and then loads them in Vivaldi in application mode. A keylogger is then launched, with input encrypted, packaged, and whisked away to the attacker's command-and-control (C2) server.

"At this time, Vizom focuses on large Brazilian banks, however, the same tactics are known to be used against users across South America and has already been observed targeting banks in Europe as well."
Click to expand...

IBM: New Vizom Malware Discovered Targets Brazilian Bank Customers with Remote Overlay Attacks

IBM Security Trusteer researchers have discovered a new malware code and active campaign targeting online banking users in Brazil. The malware, coined “Vizom” by the team, uses familiar remote overlay attack tactics to take over user devices in real time, as the intended victim logs in, and then initiates fraudulent transactions from their bank account.

Vizom hides inside legitimate executable, ensuring that the operating system would run its malicious DLLs without questioning them.
Click to expand...

Log in or Sign up

This new malware uses remote overlay attacks to hijack your bank account

guest Guest

Log in or Sign up

This new malware uses remote overlay attacks to hijack your bank account

guest Guest

Useful Searches