BackSwap Malware Now Targets Six Banks in Spain

** This post was written with IBM X-Force researcher Tomer Agayev **

IBM X-Force researchers analyzed the activity of a relatively new banking Trojan known as BackSwap. BackSwap emerged in March 2018 and, until recently, had only targeted Polish banks. The malware’s target list now features six major banks in Spain.

According to X-Force analysis, BackSwap is its own malware project, but it is based on features that existed within the Tinba Trojan. The malware’s operators keep the code as their own project; in that sense, it is considered gang-owned and not commercial malware.

A Twist in the Tale

Overall, BackSwap is no more sophisticated than any other active banking Trojan. Its highlight is its web injection mechanism. Instead of using the more common method of hooking browser functions, then creating different versions for each architecture, BackSwap injects JavaScript into the address bar.

By simulating user input to access the browser’s address bar and inserting the malicious script directly there, BackSwap can execute the script using JavaScript protocol URLs and bypass protections of both the browser and the bank’s third-party security controls.

In terms of what BackSwap does with the injections, this is where the novelty ends. Just as malware such as Zeus has been doing for over a decade, BackSwap uses malicious scripts to modify what victims see on their bank’s website in classic man-in-the-browser (MitB) style:

• Scripts wait for a minimum amount of data to be transferred before replacing the destination account number.
• Scripts inject mule account numbers on the fly via MitB.
• Scripts hide the mule account number that the money will go to and instead present the original destination account the victim entered.

Want to read about BackSwap’s fraud tactics? Continue reading this post here.