New Password-Stealing Trick Masquerades as Firefox Plugin

BitDefender
December 17, 2008 | COMMENTS

A new type of malware designed to harvest web passwords has been detected in the wild. This latest e-threat—called Trojan.PWS.ChromeInject.A —is intended to be delivered onto a compromised computer system by other malware for subsequent download into Mozilla Firefox's Plugin folder. Once installed it gets to work every time Firefox is started.

Trojan.PWS.ChromeInject.A filters data sent by users to over 100 online banking websites. The banking websites include www.bankofamerica.com, www.chase.com, www.halifax-online.co.uk, www.wachovia.com, www.paypal.com and www.e-gold.com.

Users infected with Trojan.PWS.ChromeInject.A have their login credentials sent to a web address similar to [removed]eex.ru. Both the domain and the hosting server are located in Russia, which could indicate the origin of this e-threat.

BitDefender is a security software company with offices in the UK and Florida.