New Trojan Stalks Spanish Net Users

Panda Software has issued a warning about two Trojan horses that are spread through MSN Messenger and harvest passwords to several Spanish online banking sites.

The first Trojan, named Nabload.U, downloads a second Trojan if a user clicks on a Spanish-language instant message in Messenger while also displaying two URLs that download a configuration file. The message appears to be from a personal contact, according to a Panda news release.

Then, the Trojan Banker.BSX opens port 1106 and waits to capture login and password information if the user visits any of 10 different Spanish banking sites. The login and password information is subsequently forwarded to an e-mail address, Panda says.

Capturing Keystrokes

This Trojan does not use a traditional keylogger to capture information, so banks that use virtual keyboards to avoid keyloggers won't be protected, Panda says. Virtual keyboards--seen as a security measure against keylogging programs--use electronic signals and optical recognition to recognize keys projected onto a surface rather than the pressing of keys.

Banker.BSX is difficult to recognize, as it doesn't display a message or warning that it has reached a computer, the company says.

Panda says it has tracked the spyware in Chile, Israel, Spain, Peru, and Argentina.