New Gozi Trojan Version Can Bypass Some Behavioral Biometrics Defenses

The latest version of the Gozi banking trojan that's currently under development comes with a few tricks up its sleeve, including an increased role for malicious human operators during the infection process and the ability to bypass some behavioral biometrics defenses.

This new Gozi version is currently active in countries such as Japan, Spain, and Poland, and it targets financial organizations such as PayPal, CitiDirect BE, ING Bank, Société Générale, BNP Paribas, the Bank of Tokyo, and many more.

New Gozi version detected

According to buguroo, this version of Gozi is not associated with GozNym, another banking trojan that spun off from the Gozi source code leaked online in 2015.

This new Gozi version uses Web injection attacks, as the original Gozi strain. GozNym also used Web injection attacks but