Criminals in a festive mood

Fox-IT observed a widespread phishing campaign delivering the Zeus Panda banking trojan via Google-shortened links to malicious ZIP files hosted on compromised sites; the malware performs web-injects to steal banking and credit card details from visitors of targeted banks and online retailers (e.g., Coolblue, Booking.com, Amazon, ING, ABN Amro). The report provides click statistics (tens of thousands), C2 and panel domains, a malicious dropper URL and executable hashes, screenshots of injected forms, and mitigations for users and organizations.