The malware that has been targeting Tesco Bank has several other banks and service providers on its target list, ESET researchers have found. Uncovered by ESET Threat Intelligence services, the Retefe Trojan, active in its current form since at least February, 2016, is capable of redirecting its victims to modified banking pages to harvest logon credentials. In some cases, it has also tried to trick the user into installing a mobile component of the malware (detected by ESET as Android/Spy.Banker.EZ). This mobile component was then used to bypass two-factor authentication.

Detected by ESET as JS/Retefe, this malicious code is usually spread as an email attachment pretending to be an order, an invoice or a similar file. Once executed, it installs several components including an anonymizing service Tor and uses these to configure a proxy for targeted banking sites.

Retefe also adds a fake root certificate disguised as if issued and verified by a well-known certification authority, Comodo. This makes the fraud very difficult to spot from a user’s perspective.

Retefe has been on the radar, of security researchers, in past. Most recently when it targeted UK banking customers earlier this year. Since then it has added the mobile component and extended its list of targets.

Among services targeted by the Retefe Trojan, are large banks in the UK, Switzerland (the most affected country, according to ESET LiveGrid cloud system) and Austria, as well as popular services like Facebook and PayPal.
The full list can be found below.

“The possible connection between the large attack on Tesco Bank, where thousands lost their funds and the Retefe banking trojan is disturbing. We have of course notified all companies targeted by Retefe and have offered assistance in mitigating the threat. Also, we advise users to take steps to protect themselves,” comments ESET security evangelist Peter Stančík.

ESET researchers have determined the indicators of compromise for the Retefe malware and urge users of the below mentioned services to check if their computers are infected. They can do it manually or use ESET’s Retefe Checker website, where they can find a downloadable tool that checks the computer for the mentioned indicators automatically.

Users can check their computers for Retefe by looking for the following indicators of compromise:

1.       Presence of one of the malicious root certificates claiming to be issued by COMODO Certification Authority, with the issuer’s email address set to [email protected]:

For Mozilla Firefox, go to the Certificate Manager: