creative scamming

I found this interesting.  Some scammers are using trojans to inject bogus ads and articles into business sites praising their fake investment portals.

The trojan configuration also targeted sites such as Forbes and Yahoo Finance, injecting fake articles into pages suggesting the sites were partnered with "URS Investments" and were recommended by Forbes and Yahoo and offer links to sign up with the site. Other sites which are targeted by the trojan's configuration include AOL, Amazon, Apple, CNN, Citibank and ESPN

Next stop, injecting bogus stats into popular finance portals, rss feeds, and trading sites to aid pump and dump stock scams.  Sound far fetched?  Trojans that steal banking credentials and initiate fraudulent transfers have been hiding the rogue transactions from the victims browsers for years.

Some banking Trojans overwrites transactions sent by a user to the online banking website with the criminal’s own transactions. This overwrite happens behind the scenes so that the user does not see the revised transaction values. Similarly, many online banks will then communicate back to the user’s browser the transaction details that need to be confirmed by the user with an OTP entry, but the malware will change the values seen by the user back to what the user originally entered. This way, neither the user nor the bank realizes that the data sent to the bank has been altered.