Malware News BackSwap Malware Now Targets Six Banks in Spain

[silversurfer]

Content source

https://securityintelligence.com/backswap-malware-now-targets-six-banks-in-spain/

IBM X-Force researchers analyzed the activity of a relatively new banking Trojan known as BackSwap. BackSwap emerged in March 2018 and, until recently, had only targeted Polish banks. The malware’s target list now features six major banks in Spain.

According to X-Force analysis, BackSwap is its own malware project, but it is based on features that existed within the Tinba Trojan. The malware’s operators keep the code as their own project; in that sense, it is considered gang-owned and not commercial malware.

Overall, BackSwap is no more sophisticated than any other active banking Trojan. Its highlight is its webinjection mechanism. Instead of using the more common method of hooking browser functions, then creating different versions for each architecture, BackSwap injects JavaScript into the address bar.

By simulating user input to access the browser’s address bar and inserting the malicious script directly there, BackSwap can execute the script using JavaScript protocol URLs and bypass protections of both the browser and the bank’s third-party security controls.