In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud.

Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat.

Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis.

A rising threat

As Fraud detection methods become more and more accurate, fraudsters have moved from account takeovers (ATOs) from a third-party device to on-device fraud. This can be done either by a legitimate remote access tool (RAT) or by one developed by fraudsters.

Trusteer’s customer data analysis shows that RAT device takeover has become a prevalent form of fraud, constituting a significant proportion of browser-based fraudulent activities in the U.K. and Australia.

This modus operandi started in English-speaking countries and then moved to Spain and Latin America. It has recently surfaced in France and Japan, where it was previously unreported.

Modus operandi: The classic tech support scam

A popular method fraudsters use involves a legitimate RAT, such as Team Viewer or AnyDesk, which allows them to access the victim’s device remotely. These frauds typically involve a social engineering component to convince the user to install the tool and allow the fraudsters to access their device.

Most tech support scams follow these steps:

Step 1: A user is browsing online and is redirected to a malicious website with a pop-up claiming that the device has been infected with malware. The pop-up contains a phone number to a rogue technical support team that can “assist” with “cleaning” the device.

Step 2: The user calls the phone number and is asked to download a RAT and grant the fraudster permission to connect to their device remotely.

Step 3: Next, the legitimate user establishes a banking session to pay for the services. If a one-time password is required to authenticate a new target account identifier, this action is authorized by the victim.

Explore IBM Security Trusteer Solutions

Traditional detection methods

One of the traditional methods to detect RAT is through lower mouse movement frequency.

If on-device mouse movements comprise many small, frequent events, some of these events get lost while transmitting remote mouse movements. This results in fewer measurable events.

The image below illustrates how these movements would look in a graphic form.

However, the rise of remote work during COVID-19 pushed forward many improvements in remote communication tools — RATs included — altering the old detection models.

Challenge accepted: Trusteer’s innovative solution

Trusteer’s research teams have risen to the RAT fraud detection challenge by exploring alternative detection methods. We have identified distinct behavioral patterns unique to each RAT. The unique behavioral “fingerprints” allow Trusteer’s fraud detection products to detect the use of a RAT and identify the specific tool used during the attack.

The following graphic shows the distribution of a specific behavioral event for legitimate and fraudulent sessions. The X-axis represents the number of a distinct behavioral event, leveraging data from user flow, key and mouse elements. The Y-axis represents the probability of seeing this number in fraudulent and legitimate sessions. Our research shows that a high number of events is associated with fraudulent sessions with a specific RAT, which is mainly used in central Europe.

(Source: IBM Trusteer)

These patterns have been recorded in about 20% of fraud sessions using RATs, as opposed to only 0.01% of legitimate sessions. This helps our teams detect RAT-enabled fraud with more certainty.

Stay safe from RAT fraud

RAT fraud has reached every corner of the world while becoming increasingly invisible, posing a challenge to banks and security teams.

However, Trusteer’s fraud detection system, Pinpoint Detect (PPD), can identify fraud sessions involving RATs with remarkable coverage and accuracy based on behavioral analyses.

If you have further questions about RAT fraud, please contact IBM Trusteer Enterprise Support by opening a case in the Customer Portal.

This post was made possible through the contributions of Nir Somech, Andrey Finkelshtein and Dean David Hershkowitz.

More from Fraud Protection

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

What to do about the rise of financial fraud

6 min read - As our lives become increasingly digital, threat actors gain even more avenues of attack. With the average person spending about 400 minutes online, many scammers enjoy a heyday. Old impersonation scams continue to deceive people every day, as con artists and hackers are armed with advanced technologies and sophisticated social engineering tactics. According to the Federal Trade Commission, financial fraud increased by over 30% from 2021 to 2022, with total losses surpassing $8.8 billion. This ever-evolving threat will continue to…

Crypto fraud in 2023: How can security teams fight

4 min read - Hackers stole $4.3 billion worth of cryptocurrency in 2022, making it the worst year on record for crypto fraud. While the government pushes for regulation in the digital coin market, cryptocurrency remains a volatile industry and a risky bet for investors and financial institutions. While decentralized finance (DeFi) aims to offer greater control to investors, the anonymous nature of banking on the blockchain provides cyber criminals with the smoke and mirrors they need to steal money and vanish without a…