A new type of malicious software that collects passwords for banking sites but targets only Firefox users is on the loose.
“Trojan.PWS.ChromeInject.A” sits in Firefox’s add-ons folder, said Viorel Canja, the head of BitDefender’s lab, quoted by NetworkWorld.
The malware, which runs when Firefox is started, uses JavaScript to identify more than 100 financial and money transfer Web sites, including Barclays, Wachovia, Bank of America, and PayPal along with two dozen or so Italian and Spanish banks, says the story.
“When it recognizes a Web site, it will collect logins and passwords, forwarding that information to a server in Russia,” it states, continuing:
Users could be infected with the Trojan either from a drive-by download, which can infect a PC by exploiting a vulnerability in a browser, or by being duped into downloading it, Canja said.
When it runs on a PC, it registers itself in Firefox’s system files as “Greasemonkey,” a well-known collection of scripts that add extra functionality to Web pages rendered by Firefox, adds NetworkWorld.
Read the rest here:
New Firefox malware trojan spotted