After a hit-and-run campaign against consumer online bank accounts in 2010, the Zeus Trojan now appears to be aggressively targeting a clutch of second-tier money exchange and payment services.
According to Israeli company Trusteer, which specialises in tracking the activities of Zeus and its variants, there are now at least 26 different configurations to attack one company alone, Money Bookers.
Each configuration represents a separate set of slightly different instructions on how to attack the sites associated with a brand, with the number detected being similar in scale to the number of configurations that would be created to attack much larger companies.
One thing that becomes clear is that along with the other services attacked - Web Money and Nochex, netSpend - this Zeus campaign is second-tier nature of these companies. Perhaps fearing attention, on this evidence the criminals are steering clear of large consumer payment services such as PayPal.
Ironically, the criminals have also gone after a service called e-gold, which several years ago was itself accused of being a conduit for money laundering. Configurations used against the site are sophisticated enough to try and trick the site into sending it an alternate password to access an account.