British customers of banks including NatWest, Barclays and HSBC are being targeted by a wave of malicious emails attempting to install the Dyreza malware on their computers.
The company claims that 30,000 of these emails were sent in a single day from servers in the UK, France, Turkey, US and Russia, with the aim of stealing victims’ online banking credentials.
“It installs itself on the user’s computer and becomes active only when the user enters credentials on a specific site, usually the login page of a banking institution or financial service,” said Bitdefender’s chief security strategist Catalin Cosoi.
Dyreza isn’t a new cyber-threat: it was first detected by online security firms in 2014. Then, as now, its main delivery method was emails designed to look like communications from banks, including PDF attachments.
The Trojan has been compared to Zeus, the notorious malware that infected tens of thousands of computers around the world in 2009. One of the most concerning aspects of Dyreza – also known as Dyre – is its ability to bypass the SSL security used by online banking services.
Cosoi also warned that users may be held responsible for any losses caused by their computers becoming infected by Dyreza.
“Considering the malware’s behaviour, it is worth pointing out that mitigating this vulnerability does not lie in the hands of the financial institutions targeted, but in the user’s own actions,” he said.
“It’s like using a public computer from an internet café to pay your bills – if you forget to log out from your account, anyone can access it and transfer money to their own pockets.”