Malware purveyors deliberately left USB sticks loaded with a Trojan in a London car park in a bid to trick users into getting infected.

The attack was designed to propagate Trojan banking software that swiped users' login credentials from compromised machines.

Check Point regional director Nick Lowe mentioned the ruse during a presentation at the Infosec trade show on Tuesday, but declined to go into further details, citing the need for confidentiality to protect an investigation he's involved in.

Mikko Hypponen, chief research officer of security firm F-Secure, said separately that Trojan code was replacing phishing emails as the preferred method for fraudsters to rip off users' account details.

Banking Trojans are written for profit and sold through Russian language websites and elsewhere for between $2,000 and $5,000. Two of the main groups of Trojan malware authors - Corpse and SE-Code - are based in Russia and "market" the Haxdoor and Apophis strains of banking Trojans. An unknown Russian speaking virus writer group is behind Torpig, another banking Trojan family. Malicious code variants of the Bancos Trojan are sold by an unnamed group in Brazil. ®

Related stories

Black market for malware a thriving place (6 August 2007)
http://www.theregister.co.uk/2007/08/06/malware_marketplace/
USB stick security suite puts squeeze on software (30 May 2007)
http://www.theregister.co.uk/2007/05/30/yoggie/
Eighties throwback worm spreads via memory sticks (8 May 2007)
http://www.theregister.co.uk/2007/05/08/usb_worm/
Scumbag malware authors exploit Virginia Tech tragedy (19 April 2007)
http://www.theregister.co.uk/2007/04/19/virginia_tech_malware_attack/
Trojan phishing attack claims multiple victims (23 February 2007)
http://www.theregister.co.uk/2007/02/23/trojan_phishing_attack/
US tops spam relaying and malware leagues of shame (22 January 2007)
http://www.theregister.co.uk/2007/01/22/malware_spam_report_sophos/
Viruses, phishing, and trojans for profit (26 October 2006)
http://www.theregister.co.uk/2006/10/26/viruses_for_profit/
Flight disaster phishing scam lands in Brazil (3 October 2006)
http://www.theregister.co.uk/2006/10/03/flight_disaster_phishing_scam/
UK punters still falling for phishers (25 September 2006)
http://www.theregister.co.uk/2006/09/25/banking_security_survey/
A third of dodgy emails are phishing attacks (5 September 2006)
http://www.theregister.co.uk/2006/09/05/august_malware_report/
Trojan uses smut to filch bank details (5 May 2006)
http://www.theregister.co.uk/2006/05/05/smut_trojan/
Trojan intercepts bank tokens (24 March 2006)
http://www.theregister.co.uk/2006/03/24/trojan_captures_token/
Say Hi to the mouse click capturing Trojan (16 March 2006)
http://www.theregister.co.uk/2006/03/16/mouse_click_capturing_trojan/
US man faces IRC Trojan charges (6 March 2006)
http://www.theregister.co.uk/2006/03/06/irc_trojan_charges/