3 ms·
Something nasty injected login-stealing JavaScript 50K online banking sessions
- qaz_plm 3y agoSome technical details linked from the article… https://cybersecurity.att.com/blogs/labs-research/behind-the-scenes-jaskagos-coordinated-strike-on-macos-and-windows https://cybersecurity.att.com/blogs/labs-research/behind-the...
- n_ary 3y agoSo, the malware managed to also steal OTP token too. But to make any kind of transfer, doesn’t the bank need a new OTP token entirely? This description suggests that the malware ejects itself after collecting OTP & Credentials, but by the time the miscreants tries to initiate a transfer, I expect the OTP to have expired. Only issue left is, people not using OTP and/or disabled OTP for online transactions, but that should be not possible in 2023!
- londons_explore 3y agoFor anyone got by this, note that the law in most countries requires the bank to return any funds lost through such an attack. It would fall in the same category as 'bank believed the customer instructed them to transfer funds when the customer did not make such an instruction'. The customer in this case is the actual human account holder - not the customers computer system or account. Notably, this is why lots of tech support scams try to trick the customer into transferring money, even though the scammer already has full access to the victims bank login details and browser. The scammers know that if they just make the transfer themselves, it is the bank they are defrauding, and the bank will typically try far harder to shut them down.
- lookACamel 3y agoCan you provide sources on your explanation of "the law in most countries"? In similar cases I've seen in news, the bank does not usually provide (full) reimbursement.