eFraud Online

The ZBot trojan, aka Zeus, has been harvesting FTP login data of major corporations, including the Bank of America, BBC, Amazon, Cisco, Monster.com, Symantec and McAfee.

According to the Friday edition of The Register, Jacques Erasmus, CTO at Prevx, an internet security vendor headquartered in the U.K., discovered a site where a trojan is uploading FTP login credentials from more than 68,000 websites.

Once an individual's PC is infected with the trojan, that user's stored FTP login credentials are harvested. An attacker can then login to the FTP site. The logins are believed to have been stolen during the last two weeks and some are thought to still be valid.  A variant of the ZBot trojan, hosted on a server in China, is said to be receiving the uploaded FTP credentials in plain text, making it simple for cybercriminals to gather up the data.

Zbot, aka Zeus, is an infamous information stealer that usually comes via a drive-by download on a compromised website.  Researchers are also seeing it being deployed by email with a malicious link or attachment.

Recent variants came disguised in an email claiming to be an update for Microsoft Outlook.