Zeus Trojan Targets Online Payroll Services Providers

New attack could be used for paying money mules from victimized corporate accounts

The prolific Zeus Trojan has a new role: as a tool for breaking into online corporate payroll systems.
Researchers at Trusteer today said they spotted and studied a variant of the Trojan that attacked Canadian human resources and payroll services provider Ceridian. The attack grabs a screenshot of Ceridians payroll services Web page when a Zeus-infected user logs into the site. Then the Trojan steals the users credentials, company number, and the icon he uses for image-based authentication on the site.
The more interesting issue here is whos being targeted ... payroll cloud services, says Oren Kedem, director of product marketing for Trusteer. Kedem says this could allow cybercriminals to add phony employees to the payroll -- namely money mules -- and transfer payment from the victimized business.
Weve seen with other incidents malware thats able to attack payroll systems and add fake employees, he says. But we havent seen this combination of using Zeus to [be able to] do this type of attack. Thats a new combination.
Trusteers Kedem says its unclear whether an actual attack occurred against Ceridian, but it was clear that the Zeus configuration was designed to execute a first stage of attack. We dont have information on whether the attackers got credentials and attacked an employee payroll system, he says.
Zeus is still No. 1 for cybercime, he says. This is an indication that attackers are looking at other ways of making money, he says.
Cloud providers, meanwhile, are prone to these types of attacks, Kedem says. If you were running your payroll internally, you would actually need to have access to it internally. This [Zeus] attack would not work on a non-cloud-based payroll system, so the cloud is easier to attack because you could access it from your home.
Trusteer posted a blog about the new Zeus attack here
.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Zeus Trojan Targets Online Payroll Services Providers