Something nasty injected login-stealing JavaScript into 50K online banking sessions

IBM Security analysed a 2023 campaign attributed to DanaBot or a related Windows malware family that injects malicious JavaScript into bank login pages to capture credentials and MFA/OTP tokens; roughly 50,000 user sessions across 40+ banks worldwide were affected. The injected script communicates with a C2 server, supports multiple actions (e.g., OTP prompts, fake error pages, overlays), and removes itself from the DOM to hinder detection; the report includes indicators of compromise and mitigation advice. The article also briefly highlights AT&T Alien Labs' findings on JaskaGO, a separate Go-based info‑stealer.