A Trojan horse planted by criminals was used to steal more than $1 million from the accounts of British customers of the same online bank since last month, according to an international digital security company, and the cyber attack is still underway.

 

Security firm M86 declined to name the bank, but said in a statement that about 3,000 customers of "one of the biggest financial institutions have fallen victim to a sophisticated attack by cybercriminals using Web-based malware to rob money via the bank's online banking system."

 

According to an MSNBC report, since July 5, more than $1 million, has been taken by the criminals, whose "command and control center" is believed to be in Eastern Europe, M86 said. The Trojan horse, called Zeus v3, "steals the customer's online banking ID and hijacks their online banking sessions," the firm said. "It then checks the account balance and, if the account balance is bigger than GBP 800 value (about $1,200), it issues a money transfer transaction."

 

The Trojan horse is being placed in website advertisements and users who click on those ads may unwittingly be downloading the poisonous payload to their computers. Users who do not have their Web browsers updated to the most recent versions may be the most vulnerable, says the report.

 

The Trojan horse itself kicks in when the user connects to the bank's website; the software then starts recording account details, such as passwords, as a user enters them, says the report. Zeus v3 "managed to avoid detection by traditional anti-virus software," M86 said.