In the Man in the Browser fraud method, the goal is to carry out the fraud by placing malware on the internet browser rather than stealing the user's password.
A browser extension containing malware can alter the amount and recipient information of the transfers made by the user however it wishes. Examples of applications that trigger fraud in internet banking include Zeus or Sinowal.
A MitB attack begins with a trojan (malware) that affects the operating system or software. It records user transactions without their knowledge, remaining undetected by antivirus software. The most commonly used method is email phishing.
It is generally thought that encryption technologies protect users against MitB attacks. Encryption is designed to prevent personal information from being intercepted. However, in a MitB attack, the malware can already access data on your browser after it has been decrypted. In this case, encryption becomes ineffective against this type of attack. Because MitB attacks occur locally, other security measures such as firewalls also become ineffective, just like the encryption structure.
What makes MitB so dangerous is that the process is automated with minimal or no human intervention. Since each piece of malware uses local resources and spreads exponentially, there is no upper limit on the systems that can be affected by this type of malware.
For this reason, it is very important to always stay alert against MitB attacks and to keep the security and updates of the systems we use current.
