When cyber criminals use Man-in-the-Browser (MitB) malware to commit online fraud, financial institutions are not their only targets. Dating, e-commerce, hospitality and travel sites are also being attacked, as is the gaming industry. While some cyber criminals focus on hacking into gaming company networks — for example, the PlayStation Network, Club Nintendo, Ubisoft and Konami — others use sophisticated malware to steal client credentials.

Target: Steam

The IBM Trusteer security team recently identified a new configuration of the Ramnit malware, which uses HTML injection to target Steam, the largest digital distribution platform for online gaming. In this attack, Ramnit successfully circumvents the site’s password encryption while defeating server-side detection of the attack.

With an estimated 50-70 percent market share, more than 2,000 titles and over 54 million active users, Steam is the perfect target for malware attacks. This is not the first time the platform has been targeted by cyber criminals, either; phishing attacks and credential-stealing malware have been targeting Steam users for several years now. Ramnit, however, uses much more advanced techniques to collect data and evade detection.

The IBM Trusteer security team identified the following code in Ramnit’s configuration file:

When a user accesses the Steam community log-in page and enters his or her username and password, the form is encrypted using the site’s public key. To overcome this client-side encryption, Ramnit injects a request for the password, which allows it to capture the data in plain text. The injection of this element, denoted as “pwd2,” can be seen in the second part of the code shown above:

Intuitive Malware

While this simple technique is good for overcoming the client-side encryption, it also raises an issue: Steam’s server is not expecting to receive this new element (“pwd2”) when the form is submitted, so it doesn’t know what to prevent. In fact, some security solutions detect MitB malware by looking for forms with injected elements. For example, if a form with a username and password is filled out by the user and sent to the website, the security product will scan to look for unknown elements that may indicate HTML injection malware. If the form arrives at the website with a username, password and credit card number, this will trigger an alarm indicating the user was a victim of a MitB attack.

To avoid detection, Ramnit simply makes sure the server never sees the injection by removing the injected element prior to the form being sent to the website. This can be observed in the first part of the code:

Why do cyber criminals go through all the trouble of injecting an element and then removing it when they can simply collect the data using Ramnit’s key-logging capability? The answer is simple: By using form grabbing, the cyber criminal can easily index the collected data. When a key-logger is used, there is no indication of which characters denote the username, which belong to the password and which ones are just irrelevant keystrokes. In such a case, someone needs to manually separate the wheat from the chaff.

While Ramnit uses MitB malware and evasion techniques to steal sensitive data from Steam and other organizations, Trusteer Rapport and Trusteer Pinpoint Malware Detection can detect, mitigate and remediate Ramnit infections. The IBM Tusteer security team continues to investigate new malware variants, understand their techniques and capabilities, and update its solutions in order to provide effective protection against the latest threats.

View on-demand webinar: Cybercriminals Never Sleep

More from Banking & Finance

Cost of a data breach 2023: Financial industry impacts

3 min read - According to the IBM Cost of a Data Breach Report 2023, the global average cost of a data breach in 2023 was $4.45 million, 15% more than in 2020. In response, 51% of organizations plan to increase cybersecurity spending this year. For the financial industry, however, global statistics don’t tell the whole story. Finance firms lose approximately $5.9 million per data breach, 28% higher than the global average. In addition, evolving regulatory concerns play a role in how financial companies…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

BlotchyQuasar: X-Force Hive0129 targeting financial institutions in LATAM with a custom banking trojan

16 min read - In late April through May 2023, IBM Security X-Force found several phishing emails leading to packed executable files delivering malware we have named BlotchyQuasar, likely developed by a group X-Force tracks as Hive0129. BlotchyQuasar is hardcoded to collect credentials from multiple Latin American-based banking applications and websites used within public and private environments. Similar operations conducted in late 2022 have also been noted delivering an earlier variant of this modified QuasarRAT by likely Spanish-speaking actors. BlotchyQuasar, which X-Force describes as…