Zeus Botnet Targeting Retailer Credit Cards

Via InformationWeek.com -

Just in time for the holidays, the Zeus botnet toolkit has gotten an upgrade: it now has the ability to target large retailers' credit card users' accounts.

That warning was issued on Wednesday by Amit Klein, CTO of data security firm Trusteer. "Our research group recently discovered a Zeus botnet that is targeting credit card accounts of major U.S. retailers including Macy's and Nordstrom just as the holiday gift buying season is in full swing," he said in a blog post.

Klein said the new capabilities are built into Zeus 2.1.0.8 -- the latest version -- and appear designed to steal people's credit card details so criminals can conduct "card not present" (CNP) transactions. Merchants must typically foot the bill for any CNP fraud that occurs on their cards, thus many have invested substantial resources into detecting fraudulent transactions.

Accordingly, the Zeus malware now takes additional steps to circumvent anti-fraud measures. "The attack we discovered uses social engineering to gather additional information beyond the credit card number that will make it easier for the criminal to bypass fraud detection measures used to investigate suspicious transactions," said Klein.

In particular, Zeus can inject a seemingly legitimate "man-in-the-middle pop-up," he said, which requests the user's credit card number -- for Macy's or Nordstrom, as appropriate -- as well as card expiration date, CVV security code, social security number, mother's maiden name, and date of birth. After entering the information, users hit a button that says "verify." Of course, nothing is being verified; the information is being recorded by Zeus and funneled to the criminals behind this operation.