March 6, 2013 By George Tubin < 1 min read

Last October, we wrote about a new universal man-in-the-browser (uMitB) scam that doesn’t target specific websites but instead collects data submitted to any website without the need for post-processing (parsing through logs to extract valuable data). At the time, we posted a marketing video from the webinject developer that demonstrates two uMitB attacks.

Recently, we came across another marketing video by the same developer that demonstrates a new uMitB attack that targets any website that accepts credit cards. It uses “Verified by Visa” and “MasterCard SecureCode” screens to manipulate victims. The webinject uses the Luhn algorithm to first verify that the card number submitted by the user is legitimate. If it is, the webinject pops up with a fake Verified by Visa or MasterCard SecureCode screen. This exploit is designed to capture the victim’s full card details and their Verified by Visa and MasterCard SecureCode passwords. The webinject can be purchased for $555.

This video illustrates the increasing sophistication of webinject technology and its ability to capture the data necessary to bypass additional security measures such as Verified by Visa and MasterCard SecureCode. Once malware has gained a foothold on the endpoint device, it is virtually impossible for users to tell the difference between a legitimate Web page and a malicious webinject. The only way to protect against these exploits is with technology that can prevent advanced, data-stealing malware from infecting endpoint devices and detecting/blocking it in real time when it does find its way onto the device.

View on-demand webinar: Cybercriminals Never Sleep

More from Malware

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated documents associated with finance, critical infrastructure, executive engagements, cyber security, maritime security, healthcare, business, and defense industrial production. Beginning in November 2023, X-Force observed ITG05…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today