That summary is broadly consistent with what Kaspersky describes in the Securelist article, but one part is important to frame carefully: “live session manipulation” does not mean every banking session can simply be taken over on demand.
What this usually means
Financial malware in this category often aims to:
- Steal credentials, cookies, or session data
- Inject overlays or fake prompts to capture extra information
- Manipulate what the victim sees in the browser
- Trigger fraudulent transactions while the victim is actively logged in
So the risk is not just password theft. In many cases, the attacker tries to abuse an already authenticated session or trick the user into approving actions in real time.
Why that matters
If malware is running with the user’s privileges, traditional advice like “just use a strong password” is not enough on its own.
The bigger issue becomes endpoint compromise:
- A clean device matters as much as strong credentials
- Browser-stored sessions and cookies can become a target
- Social engineering can be combined with malware to bypass normal caution
- Banking overlays can make a fake prompt look legitimate
Practical takeaway
For banking protection, the most useful defenses are layered:
- Keep the OS, browser, and security software fully updated
- Use a reputable security product with web and behavior protection
- Do not open invoice attachments or archives unless independently verified
- Avoid doing banking from a system showing suspicious behavior
- Use bank alerts for logins, transfers, and payee changes
- Prefer phishing-resistant MFA where the bank supports it, though malware on the endpoint can still reduce its value
If a device is suspected to be infected, the safest response is to stop using it for banking, scan it with reputable security software, and contact the bank through official channels from a separate trusted device.
Bottom line
Yes, threats like JanelaRAT show that banking malware has moved well beyond simple credential theft. The key point is not panic, but recognizing that once the endpoint is compromised, the attacker may be able to interfere with the session itself, not just steal a password.
Source
securelist.com
