New data-theft attack technique can run across web
Researchers have detected a "new man-in-the-browser" (MITB) attack method that uses malware capable of stealing users bank or other sensitive information entered on websites.
As opposed to traditional MITB scams – where malware sitting on victims' computers is used to monitor a list of targeted websites and then pounces when users visit those sites – this technique allows criminals to draw victims' data from an unlimited pool of sites.
Trusteer discovered the threat in late August and posted a blog this week that details the scam. George Tubin, senior security strategist at Trusteer, told SCMagazine.com on Wednesday that malware used in what the company dubbed "universal" MITB attacks pinpoints desired information, like credit card numbers, entered on any website -- and processes it immediately, rather than afterward, as in a traditional MITB scenario.
