Keylogger Found Harvesting Credentials on Top US Bank’s Employee Store

Researchers at Sansec have found an active keylogger planted on the employee merchandise store of a top US bank, potentially exposing the credentials and personal data of over 200,000 employees, according to Sansec. The malware was live for about 18 hours before removal and was designed to intercept everything typed into the site’s forms, including login credentials, payment card numbers and personal information.

It used a two-stage loader to evade detection; the first stage checks if the user is on a checkout page and then loads an external script from https://js-csp[.]com/getInjector/ for the second stage to harvest all form data, exfiltrating it via an image beacon.

Sansec notes a clear pattern linking this attack to previous campaigns, including one targeting the Green Bay Packers last year, and says this is the fifth getInjector campaign uncovered in the past 12 months, with related domains such as artrabol[.]com, js-stats[.]com and js-tag[.]com. The report highlights that standard security tools missed the threat, with VirusTotal showing only 1 of 97 security vendors detecting the malicious URL.