Risk: Low
The first piece of malware to attack Microsoft's new prototype anti-spyware product has emerged. The BankAsh-A Trojan disables Microsoft AntiSpyware Beta in an attempt to suppress any warning messages the package might display. It also deletes files within the program's folder. Unlike other items of malware, BankAsh-A makes no attempt to turn off anti-virus applications.
The main function of BankAsh-A is to steal online banking passwords from unsuspecting Windows users. The Trojan targets users of UK online banks such as Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest, and Smile. The malware records passwords and keystrokes once users of infected machines visit targeted web sites. This data is then surreptitiously transmitted to crooks, allowing fraudsters to later empty bank accounts. Rather than spreading under its own steam, BankAsh-A needs to be distributed by either spam emails or by loading it onto a maliciously constructed web site. Anti-virus firm Sophos say it's received a handful of reports of the Trojan.
The use of malicious code and phishing scams in frauds cost banks an estimated £4.5m during 2004, according to October 2004 estimates from banking group APACS. APACS and UK police warn that the use of malicious code in such attacks is beginning to eclipse conventional phishing attacks in its severity.