A new variant of the Citadel financial malware is targeting users of the Payza online payment platform by launching local in-browser attacks to steal their credentials, according to researchers from security firm Trusteer. Citadel is a Trojan program designed primarily to steal online banking credentials, but is also associated with the Reveton ransomware, which locks down computers and displays rogue alerts claiming to come from law enforcement agencies. Like most banking Trojan programs, Citadel’s hooks into the browser process can modify Web pages opened on infected computers in real time. These rogue local website modifications are known as Man-in-the-Browser (MitB) attacks and are harder for victims to spot than regular phishing attacks because the URLs displayed in the browser address bar are those of legitimate websites. The new Citadel variant discovered by Trusteer researchers contains MitB code that alters the form fields users are asked to fill in on Payza’s log-in page.