Threat Intel
ATMZOW JS‑Sniffer Linked to Hancitor‑Based Phishing Campaign Targeting US Bank Clients
Group‑IB analysts uncovered that the ATMZOW JavaScript sniffer is connected to a Hancitor malware chain used in a phishing operation aimed at customers of a U.S. bank. The campaign leverages compromised web pages to harvest credentials and deliver the Hancitor payload. Defenders should inspect inbound traffic for suspicious JS snippets, block known Hancitor domains, and enforce multi‑factor authentication for banking clients.
What happened
Group‑IB investigators discovered that the ATMZOW JavaScript sniffer, a tool used to capture user input on compromised sites, is part of a larger Hancitor delivery chain. The malicious code was deployed in phishing emails that targeted clients of a U.S. bank, redirecting victims to spoofed login pages.
Impact
Victims who entered credentials on the spoofed pages had their information harvested and then used to trigger the Hancitor downloader, which installs a backdoor for remote access. The attack can lead to credential compromise, data exfiltration, and lateral movement within corporate networks.
What to do
- Scan inbound email attachments and links for known Hancitor signatures and ATMZOW‑related JavaScript.
- Deploy web‑filtering solutions that block known malicious domains and block execution of unknown JavaScript in the browser.
- Enforce multi‑factor authentication for all banking‑related accounts and monitor for anomalous login attempts.
- Conduct phishing awareness training focused on identifying spoofed banking portals.
- Apply the latest security patches to web servers and email gateways to mitigate exploitation of known vulnerabilities.
Additional Resources
For detailed indicators of compromise, refer to Group‑IB’s public threat intelligence feeds and the Hancitor malware analysis reports.
Related articles
FakeSecurity JS‑Sniffer Campaign Targets Web Applications – Immediate Mitigation Steps
Group‑IB uncovered a new JavaScript sniffer, FakeSecurity, that injects malicious scripts into web pages to harvest credentials and session data. The campaign has affected multiple enterprise web applications, exploiting cross‑site scripting and insecure content delivery. Defenders should block known malicious domains, update WAF rules, and monitor for suspicious JavaScript payloads.
Read briefing
Revolut Customers Targeted by Phishing Texts After Data Breach
Revolut customers received suspicious SMS messages that appeared to come from the bank days after a breach that exposed personal and financial data. The phishing campaign mimics official alerts, requests camera access, and requests passwords, potentially enabling account takeover. Defenders should verify messages, block malicious domains, and enforce two‑factor authentication.
Read briefing
N0va Phishkit Campaign Targets US & EU Businesses via Legitimate SSO Abuse
A new phishing operation, dubbed N0va Phishkit, has been observed targeting organizations in North America and Europe. Attackers mimic trusted services and hijack legitimate authentication flows to harvest access and refresh tokens, granting attackers SSO access to corporate resources. Defenders should monitor for anomalous authentication requests, enforce MFA, and review token usage.
Read briefing
SMS Phishing Targeting Serbian Road Users via Fake State Authority – Global Threat
An SMS phishing operation impersonating Serbia’s state road authority has been linked to the Darcula and Phoenix PhaaS platforms, affecting motorists in Serbia and other countries. The campaign uses spoofed numbers and fake traffic fines to lure victims into revealing credentials. Defenders should verify SMS authenticity, block spoofed numbers, and monitor for related phishing indicators.
Read briefing