Advanced Zeus Trojan Hits ING Polish customers

A version of the Zeus malware to intercept one-time passcode sent via SMS (Short Message Service) is targeting customers of ING financial institution in Poland.

The blog of vendor F-Secure security Monday on this issue which was profiled on the site of a safety adviser Piotr Konieczny.

F-Secure has written that seems to be that the same style of attack found by Spanish security S21sec last September, which marked an evolution disconcerting in Zeus, one of the most advanced banking Trojans designed to steal passwords.

Zeus has changed its tactics, because some banks are now using one-time passcode sent via SMS to authorize operations performed on a desktop machine. First, the attackers infect a person's desktop or laptop. Then, when that person access to a financial institution like ING, HTML you insert fields in legitimate Web page.

These fields require the mobile phone number of person and model of your phone. When the information is entered, the attacker sends a SMS that leads to a website that will install a mobile application that intercepts messages and forward messages to another number controlled by attackers. The component will function on some mobile Zeus Symbian and Blackberry devices.

Once the installation is complete, the attacker could simply make a transfer whenever it's convenient, such as when an account has just received a deposit. A malicious user can access your account, receive the SMS code and initiate the money transfer.

ING Netherlands contacted officials in the Monday afternoon didn't have an immediate comment.

The SMS capacity of Zeus led suppliers as Cloudmark to warn about how SMS spam--or SMS messages designed to enable other malware--are a growing threat. Cloudmark sells a system that analyzes the operators SMS and can filter those that have other content that is offensive or spam.

Send news tips and comments to jeremy_kirk@idg.com