{
  "family": "bankfraud",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nBankfraud is a generic classification assigned to a broad spectrum of phishing threats, social engineering campaigns, and rudimentary trojans specifically engineered to facilitate financial theft. Unlike advanced, modular banking trojans (like Zeus or TrickBot) that rely on complex web injections, threats classified as \"Bankfraud\" typically rely on direct user deception to harvest banking credentials, credit card numbers, or authorization tokens.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe primary attack vector for Bankfraud is aggressive phishing. This includes highly targeted email campaigns (spear-phishing) impersonating legitimate financial institutions, SMS text messages (smishing) containing malicious links, or fake tech-support pop-ups.\n\nUpon successful interaction by the user, the threat operates primarily through deception:\n<ul>\n<li><strong>Credential Harvesting (Phishing Pages):</strong> The core component is often an HTML/JavaScript payload that renders a pixel-perfect replica of a bank's login portal. The malware intercepts the data submitted into this fake form and transmits it via HTTP POST directly to the attacker.</li>\n<li><strong>Local Data Theft:</strong> Some variants may scan the local filesystem for files with names like `passwords.txt`, `wallet.dat`, or `taxes.pdf`, exfiltrating them to an external server.</li>\n<li><strong>Social Engineering Hooks:</strong> The malware may display persistent, alarming pop-ups on the desktop instructing the user to \"verify their account immediately\" by clicking a link or calling a fraudulent phone number to speak with a \"fraud analyst.\"</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically less sophisticated than kernel-mode banking trojans, Bankfraud remains highly effective and poses a critical threat to individual and corporate financial assets. A successful attack can result in immediate, catastrophic financial loss and severe identity theft.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Emergency Financial Freeze:</strong> The absolute highest priority is freezing the compromised accounts. Contact the affected financial institution immediately to halt any pending transactions and cancel associated credit cards.</li>\n<li><strong>Universal Credential Reset:</strong> The victim must immediately reset their banking passwords from a *known-secure, separate device*. Furthermore, any other accounts sharing that password must also be changed.</li>\n<li><strong>Endpoint Sweeps:</strong> While Bankfraud is often web-based, if an executable or malicious document was downloaded, perform a full sweep with an enterprise anti-malware solution to ensure no persistent backdoors or keyloggers were left behind.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Bankfraud",
    "Phish.Bankfraud",
    "Fraud.Win32"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1566.002",
    "T1056.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:37:08Z",
  "type": "Phishing / Banking Fraud",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}