Zbot Banking Trojan Stole Credentials and Hijacked Online Banking Sessions

Summary

The transcript describes a banking Trojan distributed through spam emails and drive-by downloads. It collected stored credentials, alerted hackers when victims logged in to online banking, and enabled unauthorized transfers.

Key points

• The Trojan was distributed through spam emails and drive-by downloads.
• After installation, it collected credentials stored on infected computers, including banking usernames and passwords.
• The malware alerted hackers when a victim logged in to an online bank account.
• Hackers then entered the banking session and transferred money from the victim’s account.
• The transcript says the Trojan was also called zbot and used infected machines in a botnet.

MITRE ATT&CK

Related Articles

• Trojanized LiteLLM 1.107.0 Package Steals Credentials Through Python Startup Hookswiz.ioT1555
• Recorded Future’s 2026 Security Report Highlights Persistent Access and Fragmenting Cybercrimegithub.com/jacobdjwilsonT1555
• Picus Red Report 2026 Finds Shift Toward Stealth and Persistent Accessgithub.com/jacobdjwilsonT1555
• Security Now Examines AI-Driven Intrusions, Ledger Wallet Implants and ECDSA Curve OriginsSecurity NowT1555
• Malicious LiteLLM 1.107.0 Release Steals Credentials and Adds RAT Backdoorsecuritylabs.datadoghq.comT1555