Procedure examples

TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.

Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords).

TRANSLATEXT has the ability to use form-grabbing and event-listening to extract data from web data forms.

IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials. IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.

Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.

Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

XLoader can conduct form grabbing, steal cookies, and extract data from HTTP sessions.

Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.

Carberp has captured credentials when a user performs login through a SSL session.

Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.

Agent Tesla has the ability to use form-grabbing to extract data from web data forms.

QakBot can use advanced web injects to steal web banking credentials.

Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.

evilginx2 can inject custom POST arguments into requests to silently enable "Remember Me" options during authentication to stay logged in across browser sessions.

Kali365 has gathered browser session information and allows affiliate threat actors to replay stolen browser sessions within their own environment.