New JavaScript Malware Targeted 50,000+ Users at Dozens of Banks Worldwide

A March 2023 IBM Trusteer report details a sophisticated JavaScript web-injection campaign that altered banking login pages to capture credentials and one-time passwords across more than 40 financial institutions, affecting an estimated 50,000 user sessions worldwide. The obfuscated, dynamic scripts are served from a threat-controlled domain (jscdnpack.com), query a command-and-control server to determine actions (including inserting fake UI elements or showing downtime messages), and indicators suggest a possible connection to the DanaBot stealer/loader family; delivery vectors are suspected to include phishing and malvertising.