Password Trojan Stalks Spanish Net Users

Panda Software SL has issued a warning about two Trojan horses that are spread through MSN Messenger and harvest passwords to several Spanish online banking sites.

The first Trojan, named Nabload.U, downloads a second Trojan if a user clicks on a Spanish-language instant message in Messenger while also displaying two URLs (uniform resource locators) that download a configuration file. The message appears to be from a personal contact, according to a Panda news release on Monday.

Then, the Trojan Banker.BSX opens port 1106 and waits to capture login and password information if the user visits any of 10 different Spanish banking sites. The login and password information is subsequently forwarded to an e-mail address, Panda said.

This Trojan does not use a traditional keylogger to capture information, so banks that use virtual keyboards to avoid keyloggers won’t be protected, Panda said. Virtual keyboards — seen as a security measure against keylogging programs — use electronic signals and optical recognition to recognize keys projected onto a surface rather than the pressing of keys.

Banker.BSX is difficult to recognize, as it doesn’t display a message or warning that it has reached a computer, the company said. Panda said it has tracked the spyware in Chile, Israel, Spain, Peru and Argentina.

By Jeremy Kirk – IDG News Service (London Bureau)