A new variant of the Citadel financial malware is targeting users of the Payza online payment platform by launching local in-browser attacks to steal their credentials, according to researchers from security firm Trusteer. Citadel is a Trojan program designed primarily to steal online banking credentials, but is also associated with the Reveton ransomware, which locks down computers and displays rogue alerts claiming to come from law enforcement agencies. Like most banking Trojan programs, Citadel’s hooks into the browser process can modify Web pages opened on infected computers in real time. These rogue local website modifications are known as Man-in-the-Browser (MitB) attacks and are harder for victims to spot than regular phishing attacks because the URLs displayed in the browser address bar are those of legitimate websites. The new Citadel variant discovered by Trusteer researchers contains MitB code that alters the form fields users are asked to fill in on Payza’s log-in page.<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
“The Payza transaction PIN is used every time a user wants to send funds, add funds, withdraw funds or make a payment,” Trusteer researcher Etay Maor said Tuesday in a blog post.<\/p>\n
<\/p>\n
These stem from the wide use of public computers in locations such as Internet cafes and the generally low level of online security awareness, he said.<\/p>\n
<\/p>\n
“Public computers are typically at higher risk for malware infections and when used by an unsuspecting user, the chances of a successful fraudulent transfer are much higher.”<\/p>\n
<\/p>\n