{
  "family": "backswap",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Backswap is an incredibly sophisticated Banking Trojan that gained infamy for completely reinventing how financial malware steals data. Historically, banking trojans relied on complex API hooking (injecting code into the browser process) to intercept credentials—a technique modern endpoint detection (EDR) solutions easily catch. Backswap bypassed this entirely. It pioneered a novel technique: it monitors the active window, and when a banking site is detected, it simulates physical keystrokes (`T1055.001`) to inject malicious JavaScript directly into the browser's address bar or developer console.<br><br><b>Understanding Backswap (Novel Evasion Techniques)</b><br>To an end-user, the theft is invisible; their banking session appears normal while funds are siphoned in the background. For a threat analyst, Backswap represents a paradigm shift in defense evasion. By avoiding browser process injection, Backswap easily bypassed nearly all traditional banking security products and EDR hooks at the time of its discovery.<br><br><b>Execution and Simulated Keystroke Injection</b><br>Backswap is typically distributed via malicious spam campaigns (malspam) containing weaponized attachments. Upon execution, it does not inject into the browser. Instead, it utilizes Windows message loops (`T1056.002`) to monitor the title of the active window, looking for strings matching targeted banks. When a target is found, it uses the legitimate `SendInput` or `SendMessage` Windows APIs to simulate the user pressing keys. It simulates opening the developer console (e.g., pressing F12 or Ctrl+Shift+J) or selecting the address bar, pastes a highly obfuscated JavaScript payload, and simulates pressing 'Enter'. This JavaScript (`T1059.007`) then performs the actual web-injects, stealing credentials and altering transaction details.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct financial theft and full compromise of banking sessions. Host-based IoCs are extremely subtle because no injection occurs. EDR must look for anomalous usage of `SendInput` APIs originating from unknown processes, especially when interacting with browser windows. A key behavioral indicator is a momentary flicker or the brief, unexpected appearance of the developer console in the browser. Network IoCs involve the injected JavaScript communicating with a C2 server to exfiltrate stolen data.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.002",
    "T1059.007",
    "T1055.001",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection (Evaded by using simulated keystrokes instead)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.002",
      "name": "Input Capture: GUI Input Capture (Monitoring active window titles for targeted banks)",
      "tactic": "Collection"
    },
    {
      "id": "T1059.007",
      "name": "Command and Scripting Interpreter: JavaScript (The actual payload injected via simulated keystrokes)",
      "tactic": "Execution"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Altering transactions via the injected JavaScript)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint and contact affected financial institutions to freeze accounts and reverse fraudulent transactions.",
    "Hunt for anomalous, unsigned executables in the `%AppData%` or `%Temp%` directories that are making excessive `SendInput` API calls.",
    "Deploy EDR rules designed to detect processes attempting to programmatically interact with the developer consoles of major web browsers.",
    "Reset all passwords, especially banking credentials, from a known-clean device."
  ],
  "what_to_avoid": [
    "Do not rely on traditional AV 'browser protection' modules to stop Backswap; its entire design is based on bypassing those exact hooks.",
    "Avoid assuming a banking session is secure just because the browser displays the HTTPS padlock; Backswap alters the page *after* decryption."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}