Backswap

Overview

Trojan:Win32/Backswap is an incredibly sophisticated Banking Trojan that gained infamy for completely reinventing how financial malware steals data. Historically, banking trojans relied on complex API hooking (injecting code into the browser process) to intercept credentials—a technique modern endpoint detection (EDR) solutions easily catch. Backswap bypassed this entirely. It pioneered a novel technique: it monitors the active window, and when a banking site is detected, it simulates physical keystrokes (`T1055.001`) to inject malicious JavaScript directly into the browser's address bar or developer console.

Understanding Backswap (Novel Evasion Techniques)
To an end-user, the theft is invisible; their banking session appears normal while funds are siphoned in the background. For a threat analyst, Backswap represents a paradigm shift in defense evasion. By avoiding browser process injection, Backswap easily bypassed nearly all traditional banking security products and EDR hooks at the time of its discovery.

Execution and Simulated Keystroke Injection
Backswap is typically distributed via malicious spam campaigns (malspam) containing weaponized attachments. Upon execution, it does not inject into the browser. Instead, it utilizes Windows message loops (`T1056.002`) to monitor the title of the active window, looking for strings matching targeted banks. When a target is found, it uses the legitimate `SendInput` or `SendMessage` Windows APIs to simulate the user pressing keys. It simulates opening the developer console (e.g., pressing F12 or Ctrl+Shift+J) or selecting the address bar, pastes a highly obfuscated JavaScript payload, and simulates pressing 'Enter'. This JavaScript (`T1059.007`) then performs the actual web-injects, stealing credentials and altering transaction details.

Indicators of Compromise & Impact
The impact is direct financial theft and full compromise of banking sessions. Host-based IoCs are extremely subtle because no injection occurs. EDR must look for anomalous usage of `SendInput` APIs originating from unknown processes, especially when interacting with browser windows. A key behavioral indicator is a momentary flicker or the brief, unexpected appearance of the developer console in the browser. Network IoCs involve the injected JavaScript communicating with a C2 server to exfiltrate stolen data.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.002: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.
• T1059.007: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BACKSWAP {
    meta:
        description = "Detects Backswap (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "backswap" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Backswap Activity
id: 8a2a35887a98b13a15db6c424fa80823
status: experimental
description: Detects generic indicators of the backswap malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*backswap*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the compromised endpoint and contact affected financial institutions to freeze accounts and reverse fraudulent transactions.
2. Hunt for anomalous, unsigned executables in the `%AppData%` or `%Temp%` directories that are making excessive `SendInput` API calls.
3. Deploy EDR rules designed to detect processes attempting to programmatically interact with the developer consoles of major web browsers.
4. Reset all passwords, especially banking credentials, from a known-clean device.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on traditional AV 'browser protection' modules to stop Backswap; its entire design is based on bypassing those exact hooks.
2. Avoid assuming a banking session is secure just because the browser displays the HTTPS padlock; Backswap alters the page *after* decryption.

References & External Analysis

• Search "backswap" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Vitro
• Pjzab0Jsupjb
• Clipbanker
• Sohanad
• Evital

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/backswap.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.