The following are examples of malware used to conduct phishing scams. This is by no means an exhaustive list, but it is a fair representation of the different techniques and capabilities of most malware currently used in phishing attacks.

Bancos
Originally identified in July 2003, Bancos (also identified as Banker by some anti-virus companies) is one of the oldest and largest categories of phishing malware. Bancos originally targeted Brazilian banks. The arrests of a phishing crime ring lead by Vladir Paulo de Almeida in March 2005 [Leyden 2005] demonstrates the impact a trojan like Bancos could have in Brazil. Bancos monitors Internet Explorer for specific bank URLs and attempts to capture account information. Bancos can overlay certain banking web pages with a fake one that captures the information directly from a user. This includes the graphical touchpad that some banks are using on their websites for users to enter in their account numbers and PINs to counter against keystroke loggers.

Bankash
Bankash originally made news in February 2005 as the first known malicious program that attempted to disable the Microsoft anti-spyware program [Broersma 2005]. Bankash is implemented as an Internet Explorer Browser Helper Object (BHO) and targets online banking information. BHOs are “components—specifically, in-process Component Object Model (COM)3 components—that Internet Explorer loads each time it starts up. Such objects run in the same memory context as the browser and can perform any action on the available windows and modules” [Esposito 1999].

Once Bankash is installed, it monitors Internet Explorer activity for URLs of targeted banks. It uses the COM interfaces for Internet Explorer to harvest information from web pages and to display custom scam pages for banks of interest. These scam pages, which appear to be legitimate bank pages, ask the users to verify their account information. All the information available to users to verify the legitimacy of the web site (address bar,
SSL certificate, and title bar) indicates the original bank. Bankash also targets TANs (transaction numbers) used by many banks in Germany to authorize individual transactions.

In addition, Bankash targets any information submitted via HTTPS. A blacklist is used to avoid logging  information captured during SSL connections to sites that may be considered less valuable. This list is continually updated as new variants are released. Finally, Bankash scans the computer for email addresses and the Microsoft Protected Store for stored passwords.

W32/Grams
W32/Grams is an account siphoner that uses COM automation to directly steal money from a victim’s account on an online financial site. Since this malware does not target account credentials, current authentication countermeasures such as two-factor authentication do not mitigate this threat.

CoreFloo
CoreFloo (also known as AFCore) is a bot that gains remote command and control of an infected computer. Among many capabilities it provides is the ability to monitor for HTTP traffic to specified URLs. We have has received reports of this malware being used to specifically target banking sites.