{"id":25075,"date":"2021-05-24T15:30:00","date_gmt":"2021-05-24T12:30:00","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=25075"},"modified":"2026-03-27T22:28:16","modified_gmt":"2026-03-27T19:28:16","slug":"kaspersky-discovers-new-local-banking-trojan-is-going-global","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-discovers-new-local-banking-trojan-is-going-global\/","title":{"rendered":"Kaspersky discovers new local banking Trojan is going global"},"content":{"rendered":"\n

Kaspersky researchers have discovered a new banking malware from Brazil, named Bizarro, targeting 70 banks from different European and South American countries.<\/strong><\/p>\n\n\n\n

Kaspersky researchers have discovered a new banking malware from Brazil, named Bizarro, targeting 70 banks from different European and South American countries. Last year, Kaspersky researchers saw several banking trojans from South America (Guildma, Javali, Melcoz, and Grandoreiro), expanding their operations all over the globe. Collectively recognized as \u201cthe T\u00e9trade\u201d, these families employed a variety of new, innovative, and sophisticated techniques. 2021 has seen a continuation of this trend \u2013 as a new local player, Bizarro, goes global.<\/p>\n\n\n\n

Bizarro is a new banking Trojan family originating in Brazil, that is now also in other countries, such as Argentina, Chile, Germany, Spain, Portugal, France, and Italy. Just like T\u00e9trade<\/a>, Bizarro is using affiliates or recruiting money mules to operationalize their attacks, doing the cashout, or simply helping with translations. At the same time, cybercriminals behind this malware family are adopting various technical methods to complicate malware analysis and detection, as well as social engineering tricks that help convince targets to give out their online banking credentials.<\/p>\n\n\n\n

Bizarro is distributed via MSI (Microsoft Installer) packages downloaded by victims from links in spam emails. Once launched, Bizarro downloads a ZIP archive from a compromised website to implement its further malicious functions. Having sent the data to the telemetry server, Bizarro initializes the screen-capturing module. So far, Kaspersky experts have seen Bizarro using hosted servers on Azure, Amazon and compromised WordPress servers to store the malware and collect telemetry.<\/p>\n\n\n\n

Kaspersky researchers highlight that the backdoor is the core component of Bizarro. It contains more than 100 commands and most of them are used to display fake pop-up messages to users. Some of them are even trying to mimic online banking systems.<\/p>\n\n\n\n

\"pastedGraphic.png\"<\/a>
An example of Bizarro blocking a bank login page and telling the user that security updates are being installed<\/em><\/figcaption><\/figure>\n\n\n\n

\u201cCybercriminals are constantly looking for new ways to spread malware that steals credentials for e-payment and online banking systems. Today, we witness a game-changing trend in banking malware distribution \u2013 regional actors actively attack users, not only in their region but also around the globe. Implementing new techniques, Brazilian malware families started distributing to other continents, and Bizarro, which targets users from Europe, is the clearest example of this. It should serve as a sign for greater emphasis on the analysis of regional criminals and local threat intelligence, as soon enough it could become a problem of global concern\u201d, comments Fabio Assolini, a <\/em>security expert at Kaspersky.<\/p>\n\n\n\n

Learn more about the technical features of Bizarro on Securelist.com.<\/a><\/p>\n\n\n\n

To protect financial institutions from banking Trojans such as Bizarro (and others), Kaspersky experts recommend:<\/p>\n\n\n\n