While these are good means for a malware developer to make some money on the side, the golden egg is the means of accessing someone’s bank account. With online banking being so prevalent in this digital age, all it takes is to gain access to someone’s account, and a hacker can do some serious damage. Of course, making software that steals bank details is one thing – getting it onto people’s devices is something else entirely.
What Is a Banking Trojan?
This is what a banking trojan aims to do. It disguises itself as a genuine app or software that users download and install. Once installed, it then positions itself in a way to access your banking details. How it positions itself depends on the malware, as each one has a way of taking the user’s details. Once it has the login information it needs, it can beam the details back to the malware developers to grant them access to the bank account. The method of attack differs for each trojan. For example, the malware Zeus installs itself on Window’s computers via spam emails and drive-by downloads (files downloaded from legitimate sites that have been breached and infected). Once it’s installed, it uses keylogging (the ability to read a user’s keyboard inputs) to log the bank login details and send them back. It also connects itself to a botnet in order to receive further instructions. The Marcher malware, however, is designed with mobile phones in mind. It comes with a few different means of attack, but one of its more ingenious methods is the ability to replicate official banking app screens. When the user goes to open an official bank app, Marcher springs to action and overlays its own fake screen on top of it. The user thinks they’re entering their details into their app, but instead they’re telling a banking trojan all of their login details! This kind of attack can also be performed against browsers on a PC. This is known as a “man in the browser” attack, where malware changes what you see via redirection tactics. The goal is to redirect the user to a fake login page and get them to enter their details into the phoney site.
How Prevalent Are Banking Trojans?
Unfortunately, banking trojans have been on the rise in recent months. In June, Checkpoint stated that banking trojans were on the rise by a massive 50%. Kaspersky Lab then declared banking trojans the “phantom menace” of Q2 of 2018 after they hit an all-time high. As long as banking trojans make the attackers lots of money, there will always be malware floating around the Internet looking for credentials to steal.
How Do You Stay Safe from Banking Trojans?
With all this talk of trojans, it can be worrying to hear that your bank account could be in grave danger. However, as long as you keep yourself safe, you shouldn’t encounter a banking trojan yourself. The following explains how to stay safe.
Keep Your Security Suites Updates
If you have antivirus running, be sure to keep it topped up with all the latest virus definitions. As new trojans appear and old ones morph, security companies keep a log on what’s going on and update the virus definitions to identify the culprits when they appear. Keep yours updated so that you have the most up-to-date definitions of banking trojans.
Download Apps and Files Only from Trusted Sources
Malware has to get onto your PC or phone somehow, and the most common means is by downloading an infected file. Be sure to double-check what you’re downloading and where you’re getting it from – if the source seems too shady, try finding a better site. For mobile, always download apps from the official app store, and even then, be sure you’re not downloading a fake app by checking the download count and number of reviews of the app. A five-star review doesn’t mean much when it’s only a few people!
Keep an Eye Peeled for Suspicious Behaviour
Does your bank login page look drastically different than you remember it? Perhaps it’s suddenly asking you for very personal information that you’d rather not share? If something “seems off,” be sure to check if you are where you think you are before entering any details.
Use Two-Factor Authentication if Possible
Most banks realise the weight of losing your account to a hacker and have implemented a two-factor authentication method for a second layer of protection. This can include authenticator codes or a second password where you enter specific randomly-chosen characters instead of typing the entire thing. If your bank has this capability, definitely enable it. It could save your account!
Tricky Trojans
With malware being developed to steal money instead of destroying computers, a few attack vectors have spiked in usage over the months. With banking malware on the rise, it’s a good idea to learn more. Now you know how they work and how to defend yourself. Does the rise in trojans scare you? Or are you protected and secured from the threat? Let us know below.
