Banking Trojans & Site Vulnerabilities Lurk in the Shadows

While massive breaches such as with the Marriott chain and Quora deservedly attract most of the attention a new banking bot menace and jewelry website vulnerabilities also loom as threats.

The DanaBot banking Trojan is back, and has expanded beyond banking to compromise email servers by enabling it to harvest email addresses and send out spam straight from the victim’s mailbox. The latest variant of the malware achieves this by injecting JavaScript code into the pages of specific web-based email services. Among the targets are all email solutions based on based on Roundcube, Horde, and Open-Xchange.

According to Bleeping Computer, malware analysts at ESET found that one of the webinject scripts used by DanaBot can send out malicious messages from the owner’s account, as replies to emails in the inbox. This tactic accomplishes two goals: establishing trust between the sender and the recipient thus increasing the chance of the message bypassing spam protections, and the likelihood of the recipient open the malicious attachment.