ZeuS Innovations: ‘No-$H!+ Reports’
Summary: A Krebs on Security post from March 2011 describes a feature in the ZeuS trojan (version 2.0.8.9) administration panel labeled "Enable No-Shit reports," which filters harvested data down to specific items such as 16-digit credit card numbers and credentials submitted to pre-selected online banking sites. ZeuS's form grabber captures data submitted in web forms before the browser encrypts and sends it, so HTTPS sites are not protected, and a botnet pulling from thousands of infected systems can collect hundreds of megabytes per day.
What's compelling: The malware's own operators found the full haul too large to work with, so they built a filter to keep only card numbers and banking credentials - meaning the data that matters most to them is exactly what they chose to retain. Commenters in the thread also note that wiped-and-reimaged machines are routinely labeled ZeuS infections without verification, which destroys the evidence law enforcement would need.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026