Man In The Browser Carberp

Carberp hit the scene with a big bang last month targeting financial institutions with transactional two factor authentication schemes and we looked at what Carberp does to an infected system in a previous in-depth report.


Today’s Trojans are normally “just” an enabler for some sophisticated HTML and JavaScript injection into a bank website that is being targeted. The Trojan provides this Man-In-The-Browser capability and the configuration file defines exactly what happens. This is where the real damage is done. In that sense, Carberp follows the same principle as all other transactional Trojans such as Zeus, Gozi, Spyeye, Silon, etc.

While the HTML injection has been fairly static in the past (e.g. an additional ATM Pin input field), the sophistication of the injected JavaScript for Carberp is simply stunning


A must read document for security experts, which gives a fair example of Carberp.

Click here to read full article.