A Russian-speaking botmaster is offering a hosted service that allows fraudsters to steal banking credentials without the need for complex infrastructure.
The outsourced service allows fraudsters to rent a botnet and gain direct access to victims without the need to set up or maintain the infrastructure. Malware can then be delivered straight to victim machines.
The vendor's bot, compiled from a known banking Trojan that spreads through social networks, is seemingly large and diverse enough for the man-in-the-middle service.
Customers could issue a specific payload to be delivered to victims chosen according to their country and banking institution. The payload would be injected into a banking session where account information could be stolen and sent to the customer.
The attacks would be coupled with live support from the botmaster and operator.
Clients could also attempt to hijack the target machine using an additional remote control component provided by the vendor.
However, the service has drawbacks, including a limited use of bots that target only one victim at a time, and the need for the vendor to be available during the attacks, according to RSA's fraud expert Limor Kessem.
“Another side to this service offer is that the fraudster has to be available in real time to those demanding his assistance, unlike man-in-the-browser attacks and automated scripts,” Kessem said.
“Hands-on fraud schemes are time-consuming and can only target one victim at a time.”