New Online Banking Malware BackSwap And ComboJack Are On The Rise

Banking malware may be on the decline in popularity among cybercriminals these days, but that doesn’t mean it’s gone the way of the dodo, as they say.  Yes, anti-malware companies are indeed working overtime trying to stay ahead of this type of malware and they are actually quite successful at it. That means the thieves get a much lower return on investment for their efforts. But, if they modify it a bit, they can still make a buck and the victim likely won’t even know what is going on.

A recently discovered new banker malware, called BackSwap has found some innovative ways to steal your money. It uses your web browser, essentially by redirecting you right to malicious sites, where you’re tricked into entering your online banking credentials.

How it does this, is by convincing someone to open an attachment in an email message. Inside the attachment, which is usually a PDF, is the malware that just hangs out until it detects banking-related text being typed. Another malware, ComboJack, was spotted using a similar technique earlier this year to steal cryptocurrency. However, unlike ComboJack, BackSwap just peruses the URL in the browser and goes from there. If the address is one that’s in BackSwap’s list, it’ll redirect the user to a fake website. Then, it gets login credentials et voilà! It empties the bank account.

Phishing is no joke. It’s extremely effective for cybercriminals. All it takes is for one person to click on a malicious attachment and whatever malware is lurking inside of it is set loose. And don’t get comfortable with all of the perimeter security tools that are in place at your company or even at home. Those won’t protect completely against phishing. That’s because the hackers are getting better and better all the time and getting past spam filters and all those other tools. If it makes it into one person’s email box and that person isn’t paying attention and clicks it, the deed is done. As we saw with WannaCry, malware can spread very quickly and cause a lot of damage in a very short time this way.

Keep an eye out for email messages with attachments, regardless of who sends them. Definitely don’t click them (or on links) if they come from an unknown sender. If you are not expecting them, don’t click them until you confirm with the sender that it was intended to get to you. That means picking up the phone, sending a separate text, or walking over to the sender’s desk to ask. This simple task can prevent a lot of damage, cost, and frustration.

Supposedly BackSwap will only activate if the user is initiating a wire transfer and if the amounts are between approximately $2,600 and $5,300. At the time of writing, it appears to mostly be targeting Polish users too. That doesn’t mean it won’t be stateside in a jiffy. In fact, it most likely will.