Trojan threat to bank tokens

The trojan variant, called Bancos.pw, intercepts https traffic streams looking for Tan codes used by banks as a security token. Tan codes, used by banks as a security code in addition to passwords and user names, are usually sent out to customers by mail or through a text message.

Researchers at anti-virus firm Kaspersky said the trojan can intercept this information and pass it back to a phishing gang. Currently the trojan targets Postbank and Deutsche Bank.

Roel Schouwenberg, senior research engineer at Kaspersky Lab, said the number of trojans able to gather this type of infomation was still low but likely to increase in the next few months.

"I'm personally very wary of this type of malware evolution - it could well end up making the (home user) tokens currently used to secure online banking useless," he said.

Schouwenberg said he had also received samples of another trojan targetting the Netherlands-based Postbank, using similar methods to Bancos. "It was just a matter of time before the criminals turned to trojans instead of phishing," he said.