History and stories
Zeus: the banking trojan that watched people sign in
Victims typed their passwords into their real bank website. The malware was already in the browser, reading every keystroke.
1 min readStory
The short version
From 2007, a piece of malware sat inside web browsers, recording bank sign-ins and changing what people saw on screen.
The story
Zeus was first identified in 2007, when it was used to steal information from the US Department of Transportation. It became one of the most widespread pieces of malware of the next several years.
It spread mostly through phishing emails and infected websites. Once on a computer, Zeus waited for the person to visit a bank or payment site. Then it recorded what they typed, including passwords and security answers, and sent them to its operators. Some versions could even add extra boxes to the real bank page, asking for more details that the bank never requested.
Zeus was sold as a kit, so many criminal groups used it. Small businesses were hit hard: criminals used stolen online banking sign-ins to send wire transfers out of company accounts.
What changed afterward
Banks added extra checks for new payees and unusual transfers. A later version, Gameover Zeus, was taken down by an international law enforcement operation in 2014.
The lesson today
If malware is on the computer, a real website and a correct password are no protection. That is why businesses need tools watching the computer itself, and why payments should need a second approval on a separate device.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.