For example, if a submitted log-in form altered by banking malware contains a credit card number field that shouldn't be there in the first place, it could indicate to the server operator that the user was a victim of a MitB attack. However, in this Steam attack, Ramnit makes sure the server never gets to see the injected field.
The malware could use key logging instead of HTML injections to steal the data, but it would take the malware operator a lot of time to separate the actual credentials from everything else in the key logging file, Maor said. "The file itself is not easy to work with as opposed to forms that give you the data elements in a structured format. It's simply a matter of saving time and effort."
In the past, Ramnit has mainly targeted banks, but Trusteer researchers have already seen it being used to target customers of non-banking institutions, organizations and services, Maor said. "It all depends on what the operator wants to achieve; it is a sophisticated tool that can be used for multiple targets regardless of their orientation."