Researchers: Bank-Targeting Malware Sales Rise in Dark Web Markets

A variant of the Zeus banking Trojan is gaining in popularity in dark web forums, according to security researchers.

The malware targets point-of-sales systems through spear-phishing campaigns and RIG exploit kits, Threatpost reports.

“Rather than simply copying the features that were present within the Zeus trojan ‘as-is,’ Floki Bot claims to feature several new capabilities making it an attractive tool for criminals,” Talos researchers wrote.

A separate Flashpoint report, released after a collaborative analysis, states the malware is being peddled by a Portuguese-speaking actor who goes by “flokibot.”

“This actor is remarkable for a number of reasons, in particular their presence in a number of top-tier underground communities across a range of languages,” the report states.

Hackers tend to stick within their own language groups, suggesting Brazilian-based hackers are working with Russian- and English-speaking communities to advance the malware's capabilities.