The Trusteer research group recently discovered a Zeus botnet that is targeting credit card accounts of major retailers including Macy's and Nordstrom just as the holiday gift buying season is in full swing.
We captured and analyzed malware samples designed to steal credit card information, probably in order to conduct card-not-present (CNP) fraud. This attack is using a Zeus 220.127.116.11 botnet - the latest and most sophisticated version of the Zeus malware platform.
CNP fraud refers to transactions when a credit card is not physically present, as in an internet, mail or phone purchase. It is difficult for a merchant to verify that the actual cardholder is indeed authorizing the purchase. Because of the greater risk, card issuers tend to charge merchants higher fees for CNP transactions. To make matters worse, merchants are typically responsible for CNP fraud transactions. Therefore, CNP merchants must take extra precaution against fraud exposure and associated losses.
The attack we discovered uses social engineering to gather additional information beyond the credit card number that will make it easier for the criminal to bypass fraud detection measures used to investigate suspicious transactions. In this case, the social engineering method used is very credible since the victim has navigated to the card issuer's website - www.macys.com and www.nordstromcard.com - when Zeus injects a legitimate looking man-in-the-middle pop-up that requests personally identifiable information: