A new version of the Zeus trojan has been detected that can exploit the Firefox browser to carry out sophisticated fraud against online banking users, even if the financial institutions are using strong layers of protection.
Zeus 1.4, discovered by Trusteer, supports HTML injection and transaction tampering, two techniques that mean the new trojan can get around strong authentication and transaction signing solutions.
Previous versions of the malware were unable to bypass the security used by Mozilla's browser.
The Trusteer Rapport service had detected the password-stealing trojan on one in every 3,000 computers it monitors - an unprecedented rate of distribution for new financial malware code.
"We expect this new version of Zeus to significantly increase fraud losses, since nearly 30 per cent of internet users bank online with Firefox and the infection rate for this piece of malware is growing faster than we have ever seen before," said Amit Klein, chief technology officer (CTO) of Trusteer and head of the firm's research organisation, in a statement.
The company is recommending financial institutions "maintain a layered approach to malware blocking and make sure they have the proper detection, investigation, mitigation and response tools in place."
Earlier this month, an RSA Security study revealed that 88 per cent of Fortune 500 firms in the US have potentially been affected by versions of the Zeus trojan.
