OddJob Trojan spotted hijacking banking sessions
A financial Trojan able to hijack online banking sessions has been spotted.
Trusteer named the new piece of malware OddJob, noting how it could keep banking sessions going even after customers believed they had logged off. OddJob was used to log requests, grab full pages, terminate connections and inject data into web pages, with all activity relayed to a command and control server.
The malware was able to get hold of session ID tokens, which were used by banks to identify legitimate users, giving cyber criminals the cover they needed. According to Trusteer, the most significant difference between OddJob and standard pieces of malicious software is that the former only requires the hacker to ride on an existing session, rather than logging into specific online banking computers.
