Several samples of malware that target banking information have been observed to use techniques similar to phishing sites. These programs monitor for connections to specific banking URLs and either display a pop-up window or dialog box, or attempt to overlay the existing web page with a fake one. These forged screens usually prompt the user to reenter all their account information, often using the same techniques seen in phishing emails (such as a warning about fraud activity that requests the user to verify their account information).

Malware with this capability appears to be targeted against sites where sensitive information may not be easily recovered from the data submitted to the server during authentication. An example would be the obfuscation of this sensitive information on the client-side before transmission to the server, such as asking the user to enter the
individual digits of their PIN in random order. Interception of this data would reveal the correct digits, but not in their correct order. Malware attempting to counter this protection would wait for a successful login to a targeted site, then display a dialog box or overlaid web page asking the user to confirm their sensitive information, which would include the PIN number in correct order.