Spiderman: New phishing kit targets European banks

A new, sophisticated phishing kit is emerging in the digital underworld, causing serious concern for banks and financial service providers across Europe. “Spiderman,” as it’s called, uses impressively faithful replicas of banking websites and cryptocurrency platformsto extract login details, security codes and other critical information from unsuspecting users.

Pixel-perfect scams that fool even the most cautious

According to new analysis by data security firm Varonis, Spiderman is able to create phishing pages with pixel-perfect accuracy, making it nearly impossible to identify the fake websites. The targets include some of the most well-known financial institutions in at least five European countries — including Deutsche Bank, ING, Comdirect, CaixaBank, Volksbank, Commerzbank, as well as telecom providers like O2 and Blau.

See also: Four threat groups exploit CastleLoader

The phishing kit's reach is not limited to traditional banking. Spiderman can also create fake portals for popular fintech serviceslike Klarna and PayPal, as well as extract seed phrases from crypto wallets like Ledger, Metamask , and Exodus — data that can be lost for a lifetime.

Modular structure and easy expansion

One of the elements that makes it particularly dangerous is its modular structure. Its creators can easily add new banking organizations, identification services or fraud methods, following the constant changes that European banking systems make. As Varonis reports, the kit evolves in line with new security trends, thus maintaining a constantly high level of effectiveness.

Its popularity among cybercriminals is also evidenced by the fact that a single Spiderman user group on Signal already has over 750 members — a number that demonstrates how widely it has spread.

See also: Vishing attack abuses Teams & QuickAssist to deploy .NET malware

What operators see: Full access to victims' movements

Spiderman offers its operators a flexible and detailed control panel , allowing them to monitor in real time every action of the victim. With a single click, they can extract credentials, credit card details, login data and, most importantly, steal One-Time Pass (OTP) and PhotoTAN codes .

PhotoTAN, used by many European banks, is based on a color mosaic image that the user scans with their bank's official app to receive a unique code. This technology was until recently considered very secure. However, Spiderman's ability to intercept this data in real time is a serious blow to the effectiveness of this method.

Highly customizable cheating tool

Kit administrators can limit the phishing campaign to specific countries, choose which ISPs to target, block desktop or mobile users, and redirect unwanted visitors to other websites. This means the attack can be tailored to be as targeted and effective as possible, reducing unnecessary footprints and increasing cybercriminal success.

See also: Amos malware distributed via Google Ads – How are ChatGPT & Grok involved?

Risks to financial and digital identity

Researchers warn that the data collected by Spiderman could lead to serious forms of fraud: from hijacking bank account and SIM swapping to identity theft and unauthorized money transfers. The ease with which the information is collected dramatically increases the risk to users.

How are users protected?

As with any phishing attack, it all starts with a click. Experts advise users to always carefully check the URL before entering login details, look for suspicious pop-ups and never confirm a transaction when receiving an SMS or PhotoTAN without taking any specific action. In such cases, immediate contact with the bank is required.

Source: www.bleepingcomputer.com