Technology giant IBM is warning of a new cyberattack campaign that is trapping bank customers in fake browser screens as attackers view their sessions in real time.
A senior threat researcher at IBM Trusteer say The campaign is called OverlordMX and was identified in March 2026 and targeted financial institutions in Latin America.
IBM says OverlordMX is an automated banking Trojan with a man-in-the-browser framework. Unlike many automated banking Trojans, IBM says the malware puts a Spanish-speaking operator at the center of the attack, monitoring each victim’s banking session live.
The attack begins when a malicious script injects hidden overlays into the victim’s web browser. IBM says the script keeps track of the victim’s current URL and browser information every three seconds while simultaneously checking for new commands from the attacker.
When the victim reaches a valuable moment, such as a login page, a transfer screen, or a one-time password prompt, the attacker can activate a fake bank-branded overlay. IBM says the screen cannot be closed via normal actions, with no close button and blocked attempts to press ESC or click outside the window.
The overlays can collect names, phone numbers, emails, login credentials, one-time passwords, and other sensitive information. IBM says an overlay also prompts victims to download Remote Utilities Host, a legitimate remote management tool that the attacker exploits as a remote access Trojan.
Once installed, IBM says the operator can take control of the victim’s device, navigate the banking session, authorize fraudulent transfers and change account settings. IBM says stolen funds are transferred to mule accounts while the victim is in the middle of a loading screen.
The company says the campaign’s delivery method has not yet been finalized.
Follow us further X, Facebook And Telegram
Don’t miss a beat – Subscribe to receive email alerts straight to your inbox
Surf to the Daily Hodl mix
Generated image: Midjourney
Credit : dailyhodl.com
