November 2, 2011 By Amit Klein 2 min read

Cyber criminals have been busy developing webinjects for Zeus and SpyEye to orchestrate and develop malevolent attacks against certain brands. Webinjects are malware configuration directives that are used to inject rogue content into the Web pages of bank websites to steal confidential information from the institution’s customers. It’s not a contained problem, as IBM has discovered that these webinjects are being offered for sale on the online underground market.

The Underground Market: Come One, Come All

Investigations reveal that these shrewd developers are earning a decent income from selling the Zeus/SpyEye webinject services to an increasingly diverse customer base. The really interesting element is that they’re not too concerned whether the customer has the skills to use it. In fact, they’d probably prefer that they didn’t since the developers have gone to the trouble of obfuscating the Zeus/SpyEye webinjects not because they want to confuse malware researchers, but because they want to prevent the piracy of their software.

This means, ironically, that these criminals are actually taking steps to protect their own intellectual property — I suppose they have to do something since they can’t resort to litigation.

Because webinjects can’t be modified by customers, if they need localization for a specific country and language, this can only be carried out by the developers, who are only too willing to do so — for a price:

However, resale is rife. Those who have purchased a copy of webinject are openly reselling their version to anyone that wants to steal the same information from victims:

From the advertisements we’ve seen, there are multiple targets, including British, Canadian, American and German banks. The prospective customer can see a detailed description of the type of information that can be stolen from each brand, almost like ordering from a catalog.

[onespot-mobile-content]

Worryingly, the prices are pretty reasonable. According to the website advertisements:

  • One webinject pack…………………………………………………………60 WMZ/LR
  • U.K. webinject pack……………………………………………………….800 WMZ/LR
  • U.S. webinject pack……………………………………………………….740 WMZ/LR
  • Updating/modification of webinjects……………………………………..20 LR each

These prices are in WebMoney/Liberty Reserve units (1 WMZ/LR is equivalent to 1 USD).

On one of the forums, we even found an advertisement for the large pack of webinjects (19 MB) being sold for just $15-20:

Anyone with malevolent intentions and a bit of spare cash can bag themselves a bargain on the underground market — you’ve been warned.

View on-demand webinar: Cybercriminals Never Sleep

More from Threat Intelligence

Hive0147 serving juicy Picanha with a side of Mekotio

17 min read - IBM X-Force tracks multiple threat actors operating within the flourishing Latin American (LATAM) threat landscape. X-Force has observed Hive0147 to be one of the most active threat groups operating in the region, targeting employee inboxes at scale, with a primary focus on phishing and malware distribution. After a 3-month break, Hive0147 returned in July with even larger campaign volumes, and the debut of a new malicious downloader X-Force named "Picanha,” likely under continued development, deploying the Mekotio banking trojan. Hive0147…

FYSA – Critical RCE Flaw in GNU-Linux Systems

2 min read - Summary The first of a series of blog posts has been published detailing a vulnerability in the Common Unix Printing System (CUPS), which purportedly allows attackers to gain remote access to UNIX-based systems. The vulnerability, which affects various UNIX-based operating systems, can be exploited by sending a specially crafted HTTP request to the CUPS service. Threat Topography Threat Type: Remote code execution vulnerability in CUPS service Industries Impacted: UNIX-based systems across various industries, including but not limited to, finance, healthcare,…

Hive0137 and AI-supplemented malware distribution

12 min read - IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today